Content Credentials (C2PA) are parsed from the JUMBF boxes and verified with WebCrypto: COSE_Sign1 signature (ECDSA P-256/384/521, RSA-PSS), each assertion hashed against the signed claim, the file hash binding, and the certificate chain walked to a vendored copy of the C2PA trust list. Not checked: revocation, signing-time timestamp, key-usage policy.
Pixel side: quantization tables against the libjpeg standard set, double-quantization periodicity in the DCT histograms, JPEG ghosts, error level analysis, noise map, block-based copy-move. Two heavier ones run on demand. A transformed clone search: FAST-9 corners with Harris ranking spread over 64 px cells, 8-level pyramid, 256-bit steered BRIEF, similarity RANSAC binned by angle and scale, a second pass against the mirrored image, patch correlation after the fit. A local noise comparison: trimmed mean of the Laplacian residual per 32 px tile against tiles of the same brightness and texture class elsewhere in the image. Two versions of a photo can be compared; alignment tries correlation first, then the feature matcher, so crops, resizes and rotations line up.
Limits: no AI detection claims, because without credentials nothing reliable exists. The two on-demand methods are experimental and unscored: tuned on planted edits, not yet measured on a real-photo corpus. Repeated real objects match like clones, and the card says so. 24 MP cap, 16 MP for the noise comparison. Findings are things to look at, not proof either way. Vanilla JS, no framework, no CDN.
One of the client-side tools on vajba.com, built with Claude Code. No ads, no tracking.