Embed an AI disclosure label in a PNG: creator, AI use type, and tools used. Self-sign with a one-time key or sign with your own certificate. Everything runs in your browser.
This tool runs entirely in your browser. What you enter is never sent anywhere.Your input is never sent anywhere.
DetailsUpload an image
Click or drag and drop an image
JPEG, PNG, and WebP accepted. Output is PNG.
Disclosure details
Signing method
The tool generates a one-time key pair in your browser and self-signs the manifest with ECDSA (P-256). No certificate is needed. The key pair is not saved.
Add a visible badge to the image
The badge reads “AI-generated” and is drawn into the pixels of the output image.
This tool does not verify certificate-signed files after signing. Check them with a validator that can read this manifest format.
This label is not a verified Content Credentials manifest. It is a custom-format disclosure that Adobe's Content Credentials verifier and other C2PA validators will not show as verified.
What a C2PA-Style Label Is and What It Does Not Prove
This tool writes a disclosure label into a PNG image: who made it, whether AI was involved, and which AI tools were used. The label uses IPTC Digital Source Type values, the same vocabulary C2PA manifests use to describe how content was made. Your image, private key, and certificate stay in your browser.
The label is not a Content Credentials manifest signed under the C2PA Trust List. It is a JSON manifest in a custom format, stored in a PNG text chunk. Adobe's Content Credentials verifier and other C2PA validators will not show it as verified. Use it to declare AI use in a machine-readable way, not to prove who you are.
There are two signing options. Simple signing creates a one-time key in your browser and self-signs the manifest, so you need no certificate. Certificate signing signs the manifest with a private key and certificate that you upload.
When to Add an AI Disclosure to an Image
Publishing AI-generated artwork
Record how much AI went into an image before you post it or hand it to a client, in a form that software can read from the file itself.
Preparing images for an EU audience
Article 50 of the EU AI Act sets transparency rules for AI-generated content. A machine-readable label is one input to that work. It does not make an image compliant on its own.
Signing with a certificate you already own
If you or your organization already holds a signing key and certificate, you can sign the manifest with it and record the creator information in the file.
Noting AI edits to an existing image
Mark background removal, upscaling, or other AI retouching, and add a note describing what the AI changed.
How to Label an Image in 5 Steps
- Upload an image. JPEG, PNG, and WebP work, and the output is always a PNG.
- Enter the creator name, choose the AI use type, and add the AI tools you used. Copyright, date, and a note are optional.
- Choose Simple signing (no certificate) or Certificate signing (your own key and certificate).
- Decide whether to draw a visible badge on the image and where to put it.
- Click Sign and Generate PNG, then download the file.
Note: Certificate signing needs an unencrypted private key in PKCS#8 PEM format and a certificate in PEM format. Select the key type (ECDSA P-256 or RSA) that matches your key.
Before You Export: Limits and File Behavior
- The label is not verified by Content Credentials or other C2PA validators. It is a custom-format JSON manifest.
- The image is redrawn on a canvas and saved as a new PNG. Metadata in the original file, such as EXIF data or an existing C2PA manifest, is not carried over.
- The manifest includes a SHA-256 hash of the PNG image data from before the label was added, and the signature covers the manifest. The tool has no built-in verifier.
- Certificate signing does not check that the certificate matches the private key, and it does not check expiry or the certificate chain.
- Many platforms and editors strip PNG text chunks when they re-encode an image. The visible badge is part of the pixels and stays.
- Nothing is uploaded. Images, keys, and certificates are processed in browser memory and are discarded when you leave the page.
Simple Signing vs. Certificate Signing
Use this table to decide which signing option fits your situation.
| Simple signing (self-signed) | Certificate signing (your certificate) | |
|---|---|---|
| What you need | Nothing. A key is generated for you. | Private key (PKCS#8 PEM) and certificate (PEM) |
| Signature | One-time ECDSA P-256 key made in your browser | Your key, with ECDSA P-256 or RSA (SHA-256) |
| Shown as verified by official validators | No (self-declaration) | No, unless the certificate chains to the C2PA Trust List |
| Good for | Anyone without a certificate | People who already hold a signing certificate |
| Effort | One click | Upload a key file and a certificate file |
Applies to both options
Neither option makes Adobe's Content Credentials verifier show the file as verified. That requires a certificate issued through the C2PA Trust List, which this tool cannot replace.
Trust Lists and EU AI Act Article 50: What a Browser Tool Can Do
How C2PA verification works, what Article 50 asks for, and where a browser-only tool fits.
Verified manifests need a Trust List certificate
In the C2PA system, a provenance manifest shows as verified in tools such as Adobe's Content Credentials viewer when it is signed with a certificate that chains to the C2PA Trust List.
A certificate you create yourself, or a key generated in a browser, is not on that list. Even if the signing math is valid, official tools treat the result as unverified.
Article 50 asks for machine-readable marking
Article 50 of the EU AI Act requires providers of AI systems that generate synthetic images, audio, video, or text to mark outputs in a machine-readable format, as far as technically feasible. Other duties in the article apply to deployers, for example for deepfakes.
The Act does not name this tool's file format, and which duties apply to you depends on your role. Get legal advice before you rely on any label for compliance.
Why keys stay in the browser
To keep every file on your device, the tool signs inside the browser, so any key you use must be loaded into the page. Simple signing makes a one-time key pair that nobody else can vouch for.
Certificate signing uses your own key with the Web Crypto API, which produces a real ECDSA or RSA signature. It still shows as unverified in official tools unless the certificate is on the Trust List.
IPTC Digital Source Type codes
IPTC publishes the Digital Source Type vocabulary, which describes how a piece of media was produced. C2PA manifests use the same terms.
This tool offers trainedAlgorithmicMedia (fully AI-generated), compositeWithTrainedAlgorithmicMedia (AI composite), algorithmicallyEnhanced (AI-edited or enhanced), digitalCreation (digital art, no AI), and digitalCapture (camera photo, no AI). Picking the one that matches your process makes the label more useful.
Key, Certificate, and Label Errors
Expecting a verified badge in Content Credentials
You embed the label, upload the file to a Content Credentials viewer, and see no verification. Telling a client or platform that the image is verified would then be wrong.
💡 See the solution▼
Private key is PKCS#1 or SEC1, not PKCS#8
The key file starts with BEGIN RSA PRIVATE KEY or BEGIN EC PRIVATE KEY, and the tool cannot read it. The tool expects BEGIN PRIVATE KEY.
💡 See the solution▼
Password-protected private key
The key file starts with BEGIN ENCRYPTED PRIVATE KEY. The tool has no password prompt, so loading the key fails.
💡 See the solution▼
Key type or curve does not match the selection
You select ECDSA but the key is RSA, or you select RSA but the key is ECDSA. ECDSA keys must also use the P-256 curve, so a P-384 key fails.
💡 See the solution▼
Label disappears after you upload the PNG
You post the signed PNG to a social network or CMS, and the embedded manifest is gone when you download it again.
💡 See the solution▼
Sending a private key by email or shared drive
The tool never uploads your key, but the key can still leak before it reaches the tool if you pass it around in email or a shared folder.
💡 See the solution▼
FAQ: Self-Signed Labels, Content Credentials, and the EU AI Act
Q.Will Adobe Content Credentials show this label as verified?
A. No. Official C2PA validators expect a manifest in a specific binary format (JUMBF/CBOR) signed with a certificate that chains to the C2PA Trust List. This tool writes a JSON manifest in its own format (c2pa-lite/1.0) into a PNG text chunk. Treat it as a machine-readable declaration of AI use, not as proof of identity.
Q.Do I need a certificate to use this tool?
A. No. With Simple signing, the tool generates a one-time ECDSA P-256 key pair in your browser and signs the manifest with it. The key pair is not saved. Because nobody vouches for that key, the result is a self-declaration.
Q.What is the difference between Simple signing and Certificate signing?
A. Certificate signing uses a private key and certificate that you upload. The tool signs the manifest with that key using the browser's Web Crypto API and stores your certificate in the manifest. It does not check that the certificate matches the key, and it does not check expiry or the certificate chain. A certificate that is not on the C2PA Trust List will not make official validators show the file as verified.
Q.Are my images, private key, or certificate uploaded anywhere?
A. No. Signing runs in your browser, and the tool does not upload your image, key, or certificate or store them on a server. They are held in memory and discarded when you close or reload the page.
Q.Does this meet the transparency rules in Article 50 of the EU AI Act?
A. It may help, but this tool cannot tell you. Article 50 requires AI-generated content to be marked in a machine-readable format, and the obligations depend on your role (provider or deployer) and the type of content. The Act does not name this file format. Ask a lawyer or compliance specialist before relying on it for legal purposes.
Q.Why is the output always PNG?
A. The tool redraws your image on a canvas and saves it as a new PNG, then adds the label as a standard PNG text chunk (iTXt). That is simpler and more reliable than editing JPEG or WebP metadata directly. JPEG and WebP uploads are converted to PNG, so the output file can be larger than the original.
Q.Does the signature cover the image itself?
A. Indirectly. The manifest includes a SHA-256 hash of the PNG image data as it was before the label was added, and the signature covers the whole manifest. If the pixels change later, the hash will no longer match. This tool does not include a verifier, so you would need to check that yourself.
Q.Which AI use type should I pick?
A. Pick the one closest to how the image was made. Choose Fully AI-generated for an image produced by a generative model, AI composite when you combined your own material with AI-generated elements, and AI-edited or enhanced when AI altered an existing image (for example background removal or upscaling). Use the two No AI options for camera photos and for digital art made without generative AI. If none fits cleanly, describe the process in the custom note.
Q.Will the label survive if I upload the image to social media?
A. Often not. Many platforms and image editors remove or rewrite PNG text chunks when they re-encode a file, so the embedded manifest may be lost. The optional visible badge is drawn into the pixels, so it stays in the image.
Q.How can I read the label back out of the file?
A. The manifest is stored as JSON in a PNG iTXt chunk with the keyword C2PA-Lite-Manifest. Any tool that lists PNG text chunks can show it. After signing, you can also open the manifest JSON preview on this page.
Your feedback
makes this tool better.
Tell us which features you'd like, what should be fixed, or which new tool you'd like to see. An engineer reads every submission and uses it to guide development.