ProvSeal
Free extension FREN Pilot programBeta

Extension documentation

The free ProvSeal browser extension helps you verify, explain and test-sign C2PA Content Credentials locally. Use this documentation to inspect files, scan visible page media, create test certificates and understand trust status.

Desktop and Console are documented within the pilot program.

Built to run locally

Verification and signing workflows are designed to run in the browser extension.

  • Selected files and signing identities are not uploaded to a ProvSeal backend.

Use the extension for file, page and signing checks

Core workflows for verifying files, scanning pages and test-signing media with Content Credentials.

Verify a local file

Check whether a supported image, PDF, MP4, MOV or WebM file includes C2PA Content Credentials and open the full report.

  1. Open the C2PA Signer extension.
  2. Keep the Verify tab active.
  3. Drop a JPEG, PNG, PDF, MP4, MOV or WebM file into the local verifier.
  4. Read the status badge and report details.

Scan media on a web page

Inspect supported visible media on the current tab and compare C2PA status badges.

  1. Open the page you want to inspect.
  2. Open the extension popup.
  3. Click Scan this page.
  4. Open reports for media that need review.

Create a test certificate

Generate a C2PA-compatible test certificate for demos, development and internal validation.

  1. Switch to the Sign tab.
  2. Choose Test identity.
  3. Confirm certificate details.
  4. Use it only for test signing workflows.

Sign with Content Credentials

Attach C2PA Content Credentials to a supported image using a test certificate or imported signing material.

  1. Select a test certificate or import .p12/.pfx signing material.
  2. Choose the file to sign.
  3. Run the signing workflow.
  4. Download and verify the signed output.

Read the four C2PA statuses consistently

Status logic for Trusted, Not recognised, Invalid and No information.

  • Trusted

    Valid Content Credentials with a recognized certificate chain.

  • Not recognised

    The signature can be valid while public trust is not recognized.

  • Invalid

    C2PA data exists, but signature or integrity validation failed.

  • No information

    No C2PA evidence was detected. This does not mean the content is fake.

Understand test certificates and imported signing material

Test certificates are for demos; imported signing material is for controlled workflows.

Demo

Test certificates

Test certificates are useful for demos, learning and internal validation. They can show how a C2PA signing workflow behaves, but they are not public production trust.

Production

Imported certificates

Imported signing material such as .p12 or .pfx files can support controlled workflows. Private keys should be handled carefully and should not be imported into environments you do not control.

How a trusted result is evaluated

Three checks, in order, from the manifest signature to a recognized trust source.

  1. Manifest signatureThe extension checks whether the manifest signature can be verified with the signing certificate.
  2. Certificate pathThe certificate chain is evaluated from the signing certificate toward an issuing authority.
  3. Recognized trust sourcePublic trust depends on whether the chain terminates in a recognized C2PA trust source.

Try it locally.

Install the free Chrome extension or request an Enterprise pilot for Desktop and Console.

Install extension