How do I prove my own photograph is real when a client asks for evidence?
You cannot prove a photograph is real after the fact; you can show a chain of custody that is hard to fake. The strongest link is a camera that signs the file at capture with Content Credentials. With your current camera, keep RAW and catalogue history, and add Content Credentials at export so your identity...
Cite
Global 100 Forum, "How do I prove my own photograph is real when a client asks for evidence?", https://forum.global100.org/q/how-do-i-prove-my-own-photograph-is-real-when-a-client-asks/, accessed 2026-10-15.Photo editor by day, and I still shoot commissions on the side. Twice this year a client has asked, before accepting delivery, for "proof the images are not AI". Once it was a brand, once an NGO whose funders had been burned by a stock image that turned out to be generated. Reasonable request. I did not have a good answer.
What I have today: RAW files, EXIF with camera serial and timestamps, Lightroom catalogue history, and my word. I sent the NGO a RAW and a screen recording of the catalogue. They accepted it, but their compliance person asked whether there was "a certificate" and I had to say not really.
What I think I know: Leica shipped a camera that signs images at capture, and I have read that some Sony and Nikon bodies now do or will do the same with Content Credentials. Adobe has a free app that adds credentials to files. What I do not know is how any of this fits together for a working photographer with a four-year-old camera.
So, from people who have done it: what do you hand a client? Is the in-camera signing worth upgrading for, or is RAW plus a clean workflow enough? And does adding credentials at export actually prove anything about the capture, or only about me?
- Accepted answerTomas ReyesStaffEdits the deepfakes and provenance sections ·
You cannot prove a photograph is real after the fact; you can show a chain of custody that is hard to fake. The strongest link is a camera that signs the file at capture with Content Credentials. With your current camera, keep RAW and catalogue history, and add Content Credentials at export so your identity and edits travel with the file.
The point-of-capture piece is what the Content Authenticity Initiative announced with Leica in October 2023, in "Leica Launches World's First Camera with Content Credentials". The M11-P implements the C2PA standard in the camera: each image carries secure metadata about make and model, who captured it, when and how, and receives a digital signature at capture, checkable at contentcredentials.org/verify or in the Leica FOTOS app. The post then shows the signed image opened in Photoshop with the sky replaced; the edit becomes part of the credentials, and Verify shows the original beside the altered version. That is your compliance person's "certificate". Sony and Nikon have since brought Content Credentials to some bodies, in some cases by firmware, so check your model's page before assuming you need a new camera.
For the four-year-old body, the free Content Authenticity app is the practical step. You can verify your name through LinkedIn, connect social accounts, add a statement asking that generative models not train on the image, and apply credentials to JPEG or PNG files up to 20 MB. Adobe calls them durable and recoverable: an invisible watermark in the pixels lets the Inspect feature recover the credential even from a screenshot. Adobe keeps no copies, so the signed file you download is what you deliver.
Be straight with clients about what each layer says. Credentials added at export attest that you, a verified identity, signed this file on this date with these edits. They do not attest that the pixels came from a sensor; only in-camera signing does. The C2PA basics thread covers the limits, including what happens when a platform strips the metadata.
4 more replies
Most helpful first- Sam WhitlockMember ·
RAW is good evidence, Lena, but "cannot be faked" is too strong. A RAW file is a container with a known structure. Tools exist that write DNG files with whatever pixel data you give them, and EXIF is plain text you can rewrite with a one-line command, serial number and timestamps included. What RAW buys you is a bigger, more awkward artefact to forge, and a story that has to stay consistent across the RAW, the sidecar, the catalogue timestamps, the lens profile and the sensor noise pattern. That is a provenance argument, and a decent one. It is not a proof.
The only thing that approaches proof is a signature made with a key the forger does not hold. That is what in-camera signing does: the camera signs the capture, and anyone can check the signature later. Everything added after capture, including Marco's catalogue history, is testimony about the file rather than a property of it.
- Ingrid V.Member ·
Marketplace view, since we are on the receiving end of exactly these demands from buyers. What we accept today, roughly in order of weight: a Content Credential chain that verifies, then RAW plus a signed statement from the creator, then everything else. We built that order after a run of disputes in which both sides had JPEGs and nobody had anything that could be checked.
Two practical notes for Marco. First, almost every platform, including ours until recently, strips metadata on upload, so deliver signed files directly to the client, not through a chat app or a social DM. Second, put the provenance statement in your delivery terms now, before anyone asks: what you capture with, what you keep, what you sign at export. Clients stop asking for a certificate when the answer is already in the contract.
- Marco FerriMember ·
@Tomas Reyes this is the structure I was missing, thank you. "Credentials at export say who signed and what changed; only the camera can say where the pixels came from" is the sentence I will put in front of the compliance person. I will set up the app this week and add Ingrid's provenance paragraph to my delivery terms. Whether the in-camera signing is worth an upgrade probably depends on how many more of these requests arrive; I suspect the answer is all of them.
Write something first.
Give people something to work with: at least 30 words on what happened and what you tried.
That is too long. Keep it under 6,000 characters.
Write the question as the title, 15 to 140 characters, no links.
Pick a category.
Add a name (2 to 40 characters, no links).
That email address does not look right.
That was quick. Read the thread, then try again.
The form expired. Reload the page and post again.
Something went wrong with the form. Reload and try again.
Please complete the check and post again.
Limit reached for now. Try again later.
This thread is closed to new replies.
This thread no longer accepts replies.
Something went wrong with the form. Reload and try again.
Post a reply or question first (name and email), then this browser can vote, edit and accept answers.
You cannot vote on your own post.
Only the author (within 30 days) or the forum team can do that.
That email belongs to a forum team account. Use your sign-in link instead.
New accounts are paused for the moment. Try again later.
That was already posted.