Source Kit is a cryptographic camera app that embeds each photo and video with a signed record of how it was made — which device, which instant, what the sensors read, what a second lens saw — so anyone can check later where a file came from and what has happened to it since.
The record is signed and sealed into the file at the moment of capture, as a standard C2PA manifest. It works without a network, and it can be checked with any C2PA tool.
Download the beta
Free. No account. Your photos never leave the phone.
Secure Enclave and App Attest need real hardware. The simulator falls back to a software key and says so.
An open source proof-of-concept
All of Source Kit's code is published under Apache-2.0. I'm a journalist turned product designer, not a cryptographer or a career engineer. Everything is here: camera, cryptography, native modules, interface, test suite.
Image not bundled — run site/assets/fetch.sh to pull the public-domain original from Wikimedia Commons.
Frances Griffiths and the Cottingley Fairies, 1917. Photograph by Elsie Wright, first published in The Strand Magazine, December 1920. Public domain in the United States; via Wikimedia Commons.
In July 1917 two girls in the Yorkshire village of Cottingley photographed some fairies at the bottom of the garden. The images were examined by Arthur Conan Doyle, who found them persuasive, and by Kodak, which declined to certify them but conceded it could not prove them fake. The fairies were cardboard, copied from a children's book and held up with hatpins. What is striking about the Cottingley affair is not that anyone was fooled but that the question was already understood to be a technical one, a matter for Kodak, rather than a question about two girls and a hatpin.
Retouching is as old as the negative. At Gettysburg in 1863, Alexander Gardner's team moved a dead soldier forty yards into a rocky niche and leaned a rifle beside him. Soviet censors airbrushed the disgraced out of group portraits for fifty years before Photoshop shipped in 1990. Back then a convincing lie took a darkroom, a skill and an afternoon, and picture desks, wire services and libel law made the attempt more expensive still.
Generative models did not make images forgeable. They made forgery fast and essentially free.
Every one of these laws leans on one of two technologies
So far in 2026, U.S. state legislatures have introduced 1,143 artificial-intelligence measures. Of those, 319 concern deepfakes, provenance, or transparency. Forty-four have already become law — more than any other subject except the rules states are writing for their own agencies.
The impulse is not confined to the United States. The EU AI Act's Article 50 became applicable on August 2, 2026, requiring machine-readable marking of AI output and a visible label on deepfakes, with penalties up to €15 million or 3% of global turnover. California's AI Transparency Act took effect the same day, China has required labeling of synthetic media since its deep synthesis rules, South Korea criminalized sexual deepfakes without an intent-to-distribute test, and Denmark has moved to treat a person's face and voice as their property. The mechanisms diverge; the two technical demands underneath them do not.
1 / Requiring invisible watermarks on generated media
A watermark rides inside what a model generates, and it holds up against ordinary handling. It does not hold up against effort. Regenerating an image through a diffusion model strips the mark and keeps the picture, one watermark can overwrite another, and the tools to do it are published. Open-weight models emit nothing to strip in the first place. Detection has the same shape of problem: a classifier chasing a generator gets worse exactly as the generator improves.
2 / Requiring all media to carry tamper-proof data about its provenance
Provenance is a word borrowed from the art trade, where it means the paper trail of a painting's owners — the chain of receipts, bills of sale and catalog entries that says where a canvas has been since it left the studio. It was never a claim about the painting. A perfect provenance on a forgery is a well-documented forgery, and the trade has bought plenty of those. What the paper trail does is make lying laborious, because the liar has to manufacture a history rather than an object.
The digital version is the same idea with a cryptographic signature instead of a filing cabinet. Adobe, Arm, the BBC, Intel, Microsoft and Truepic founded the Coalition for Content Provenance and Authenticity in February 2021, and the first specification followed a year later. Instead of examining a file for signs of forgery, seal it at the source so any later change reads as a change. A watermark says a machine was involved. A manifest says which device, which moment, and what has happened since.
From bytes to photons
Between the sensor and the signature there is a stretch of code. How long it is decides what the signature is worth.
Roughly thirty milliseconds separate the photons from the pixels, and every stage of it runs before any third-party app is handed anything. A Pixel 10 signs at A. Source Kit signs at B.
A photograph starts as charge on a grid of sensor wells and ends as a file. Everything in between — demosaic, lens correction, noise reduction, tone-map, encode — is code that could hand the next stage a different picture. What a signature proves has less to do with the key than with how much of that chain stands between the photons and the signing.
C2PA grades signers on two levels: keys protected in software, or keys in hardware with a live attestation from the silicon. The Pixel 10 is the first phone to reach the second, signing inside the imaging pipeline with the key in the Titan M2. The frame never passes through general-purpose code, so there is no seam where another image could be substituted. Qualcomm has the same idea in the Snapdragon secure environment. Dedicated cameras got there first, starting with Leica in 2023.
Source Kit sits at the far end. It signs the bytes the operating system hands it, with a key in the Secure Enclave, and can attest to nothing upstream of that hand-off. That is the ceiling for a third-party app on iOS, which is why it commits more around the frame instead of claiming more about it.
What it commits
Each of these exists because of a gap named above. All of it optional, and all of it switchable in the viewfinder.
Hardware attestationProof the key is held somewhere you cannot reach into.
On Apple the strongest available primitive is App Attest, which certifies that a genuine iPhone is running an unmodified build of this app, and then hands it no access to the key it just attested.
The two get tied together with a commitment. The attestation's clientDataHash is set to SHA256(challenge ‖ signingPublicKey), which pins Apple's certificate to this exact key rather than to some key on some genuine device. The binding travels inside every manifest, and anyone can recompute it offline years later. appAttest.ts
Independent timestampingTime runs one way, which is what makes it provable.
Time is the rare claim that can be proved rather than asserted, because it only moves forward. Nobody can place a digest in a Bitcoin block mined before the file existed, and no timestamp authority will countersign something it has not yet been shown.
So a capture carries an RFC 3161 countersignature, verified cryptographically on device instead of read off the token, and an OpenTimestamps receipt that lands the record's digest in a block. Some newer hardware runs a timestamp authority on the device itself, so a capture made in airplane mode still carries trusted time. timestamp.ts · ots.ts
Organizational credentialsOptional. The only thing that can attach a name to a key.
A self-signed device key proves consistency and nothing about who you are. An organization can supply the missing half by issuing a certificate for the device's public key, which never requires the private key to leave the Secure Enclave. Every signature then chains into the newsroom instead of into itself.
There is a hands-off version: an organization publishes a static document at /.well-known/sourcekit-org.json listing member fingerprints and their certificates, and a member enters the domain rather than passing files around.
Revocation stays with the organization's CA, over the OCSP and CRL endpoints in the certificates it issues, so any verifier can ask. A credential that no longer matches the active device key is ignored and flagged. orgCert.ts
A verdict that refuses to be a badgeFour questions, four answers, no checkmark.
A checkmark borrows the authority of whoever did the checking, and there is nobody here to borrow from. So the result is four questions, each answered on its own evidence, and each one a rung the file either reaches or does not:
Media unchanged since signing. The signature verifies and the bytes match what was signed.
Signer identified. Something outside the file vouches for the key — a signed roster or a curated trust list.
Key attested by Apple hardware. Apple certifies the key is Enclave-resident on genuine hardware.
Time bracketed by an independent anchor. A pinned-authority countersignature or a verified Bitcoin anchor.
Each rung reads reached, not reached, failed, or not applicable, and the unreached ones say why. Unsigned renders neutral grey rather than red, because the absence of a credential is not evidence of tampering. Verified, authentic and trusted all name a conclusion somebody reached, so none of them appear in a verdict position anywhere in the app. trustLadder.ts
Privacy and data redactionA record of the photograph is also a record of the photographer.
Because the record is sealed at the shutter, it documents where the photographer was standing, when, on which device, and sometimes under what name. For most work that is a credential. For someone photographing a police stop, a picket line or a border crossing, the same file is a piece of evidence about them, carried in voluntarily and impossible to recall once shared.
So the choosing happens before the shutter, not on export. Every field is committed under its own salt into a signed Merkle tree, which lets a verifier tell three states apart. Disclosed is what it sounds like. Withheld means committed but absent, with no ciphertext for anyone to attack. Never-recorded is declared at capture and bound into the root, so a field you withheld cannot later be passed off as one you never collected.
Reveal a field later and it still verifies against the original signature. Destroy the seed and the withheld fields become permanently underivable by anyone. src/disclosure
A second lensA second viewpoint, sealed in the same file.
Because the second camera is already there and already running, it costs almost nothing to seal. Source Kit seals a simultaneous downsampled ultra-wide frame into the same file, as a C2PA ingredient with relationship componentOf. Open the photo in any C2PA reader and the second viewpoint is there.
An ultra-wide sees far more of the room than the frame you composed. A monitor bezel, the edge of a laptop, the glow off an OLED panel — all of it lands in the second view.
Past that, the geometry. Two lenses a known distance apart see a flat plane identically and a scene with real depth differently, and no homography removes the difference. On an iPhone Pro they sit about 19.2 mm apart. How far that reaches depends entirely on the resolution you measure at: the quick card inside the app decodes both views at 96 px and runs out around 1.3 m, while the 640 px frame sealed into the file reaches roughly 9 m. Rephotography sits at the easy end of both. A monitor filling the frame is about 60 cm from the lens, where the two views disagree by enough to be unmistakable at either resolution.
Parallax range calculator
Disparity = focal length in pixels × baseline ÷ distance, with focal length taken from a 70° horizontal field of view at the analysed width. A patch has to shift by at least one pixel to be measurable, so that is the range floor. Below roughly 9 cm the shift exceeds the ±14 px search window and matching fails outright.
The card reports the matched-patch count and the median disparity. MultipleLensCard.tsx
The motion of your handNobody holds a phone still, and the wobble is specific.
A window of gyroscope and accelerometer samples from around the shutter rides in the record. Not every photograph is handheld: a tripod or a copy stand reads as still, which is its own kind of answer. But for the ones that are, hand tremor over a second or two is unglamorous and highly particular, and a generator does not produce it by accident.
On a video or a burst — an option in the viewfinder — that trace is drawn against the optical flow of the frames themselves, so the movement the device felt is checked against the movement it saw. poseTrace.ts
Which way the phone was pointingSensor readings the picture itself can contradict.
The device knows which way is down from gravity, and roughly where north is from the magnetometer. Read together at the instant of the shutter, they give the direction the camera was pointing. Each of those predicts something visible in the frame: where the horizon should sit, and, with the signed time and place, which way shadows should fall.
Where gravity says level was. The line is drawn from the sealed accelerometer reading, not from the picture, so a frame whose real horizon runs somewhere else disagrees with it visibly.Where the sun was, computed from the sealed time and place alone. It gives a direction and a length: a meter-tall object should throw a 0.68 m shadow to the northeast. The picture either agrees or it does not.
None of this reads the content of the picture. It looks for agreement between what the sensors claimed and what the frame shows. A recapture of a screen inherits the screen's horizon rather than the phone's.
Any one of these values can be spoofed alone. They are useful together: a forgery has to satisfy all of them at once, which is a much harder thing to arrange than any single one. That is a cost rather than a wall, and the kind of cost that falls as generative systems get better at physical consistency. context.ts
A raw audio masterCompression discards exactly what makes audio checkable.
Because delivery codecs throw away whatever the ear will not miss, they also throw away what forensic work needs. So alongside the compressed track, a PCM master is converted from the same native buffers at 16 kHz: not perceptually coded, and resampled low enough to keep the room and the mains band while discarding everything above 8 kHz and its hash signed into the record.
The best-known use is the mains hum. Grids run at 50 or 60 Hz and drift in a pattern shared across an entire synchronous interconnection, distinctive enough over a long enough window to place a recording in time, so indoor audio carries a rough timestamp nobody can forge without the grid's own history. Matching against a grid database conventionally wants ten minutes or more of continuous audio; getting there on shorter clips is an open research problem.
The more interesting direction is agreement between channels. The same grid frequency that modulates the hum also modulates the light: fluorescent tubes, and LED fixtures with unfiltered drivers, flicker at twice the mains rate, so the flicker measured in the picture and the hum measured in the sound are two readings of one physical quantity. A track dubbed in later has no particular reason to agree with the room it is supposed to have been recorded in. The comparison is still a research problem. Source Kit seals the raw audio; it does not yet check the two channels against each other. capture-kit
Forensic checks any person can runPhysics the signed record has to agree with.
A signed timestamp constrains what the scene is allowed to look like. The sun's elevation and azimuth are deterministic from a time and a place, so a low sun and a noon timestamp do not add up. The card draws where shadows should fall and lets you compare.
Nothing here returns a score. The signed claims are rendered against independent physical expectations, and a check that could not run says so. src/components/forensic
A post-quantum signatureCheap now, and photographs get read decades later.
Every record carries an ML-DSA-65 signature over the same commitment as the ECDSA one.
It is a bank vault door on a garden shed, and worth fitting anyway. The elliptic-curve signature is nowhere near the weakest thing here, and anyone with a quantum computer would still find it easier to point a camera at a screen. But the cost is a few kilobytes and a library that already exists, and a photograph taken this week might be read in a hearing or an archive in twenty years — by which time the signature protecting it could be the one part that has quietly stopped meaning anything. Nobody gets to re-sign the archive later. pq.ts
Works without a networkSealing and verifying both, with the radio off.
No accounts, no analytics, no launch-time network calls, and no registry address bundled in the app. Sealing reaches the network only for a timestamp authority and a Bitcoin anchor, and a capture made offline signs anyway and says which anchors are missing. Reading a file can reach further: the weather comparison sends the sealed coordinates to a third party. All eight calls are enumerated in the docs with what each one discloses.
Apple's Reference Image sends the raw image, sensor signatures and hardware identifiers to Private Cloud Compute and returns an authenticated copy. That is a reasonable trade for most people, and not available to someone who cannot afford to be seen talking to a server. NETWORK.md
Where it still comes up short
Six ways a file can carry a perfect signature and still mislead you. A published academic review of the specification, Golaszewski et al. at UMBC, found implementation problems on top of these — disagreeing validators, weak revocation, an exclusion range that hides edits. Those are fixable. The six below are structural.
partially addressable
Rephotography
The lens can be pointed at a screen
Photograph a good monitor and every guarantee holds, because every guarantee is true: the sensor did see those photons. No signature reaches past the front of the lens.
partially addressable
Sensor spoofing
A signature binds a claim without checking it
Civilian GPS is unauthenticated and a spoofer can be assembled from a software-defined radio for a few hundred dollars. The scene is real, the signature is valid, and the place is wrong — sealed just as faithfully as a true one.
addressable
Metadata stripping
Most platforms strip the credential on upload
The manifest disappears the moment a picture starts to travel, and a stripped file is indistinguishable from one that was never signed. The remedy is a perceptual fingerprint and somewhere to look it up. The fingerprint is here; the registry is not.
addressed in new devices
Software injection
Below Level 2, a picture can be handed to the signer
If the frame reaches the signer through code nobody attested to, whatever arrives gets signed correctly. A researcher did this to the Nikon Z6III through its multiple-exposure mode; Nikon invalidated every certificate it had issued.
no viable solution
Staged reality
A staged scene is a true photograph of a lie
Everything here would have sealed the Cottingley fairies without complaint. Real camera, real garden, real light, real distance. Two lenses would measure genuine depth, because there was genuine depth. Every check passes, and every one is telling the truth.
addressable
Redaction
Protecting someone in the frame breaks the proof
Blur a bystander's face or crop a landmark and the signature fails, giving the same verdict a forgery gets. Selective disclosure covers the metadata, so fields can be withheld and still verify. Nothing yet covers the pixels.
Most of what Source Kit commits is aimed at rephotography, the one failure that stays open however good the hardware gets.
The danger in a permanent record of everything
A file that can prove where it came from can also prove where you were.
A wedding photographer wants every field filled in. A photographer at a protest wants the frame and nothing else, because the GPS fix that corroborates a story for a picture desk also places a named person at a named corner on a named afternoon. There is no setting that is right for both, so the choice gets made twice: once at the shutter, and again at export.
Both are the same mechanism. Every field is committed under its own salt into a Merkle tree, and the signature covers the root rather than the values — which is what makes three states distinguishable to a verifier instead of a matter of trust. A field can be disclosed, present and checkable. It can be withheld: committed at capture, absent from the file, with no ciphertext for anyone to attack later. Or it can be never-recorded, declared at capture and bound into the root, so the file carries proof that the sensor was off.
That last state is the one that matters under pressure. A file with the location redacted invites the question of what was removed and why. A file that never recorded a location can demonstrate as much to anyone who asks, cryptographically, without asking to be believed. And a field withheld today can be revealed years later and still verify against the original signature — or the seed can be destroyed, and it becomes permanently underivable by anyone.
Before the shutter. The list is split in two — what identifies you, and what describes the moment — with the identifying half off by default.
At export. A second decision, per recipient: a re-sealed copy with the identifying fields removed, or the file exactly as sealed.
What a recipient sees. Redacted by signer, stated as such rather than left as a gap to interpret.
Signal
What it records
What it's worth
Multiple lenses
A second, downsampled view from a different physical camera, plus calibration.
Geometric and measurable. The only signal that speaks to the scene rather than the file.
The one context claim not sourced from the device itself.
Motion log
Gyro, attitude and user acceleration around the shutter, decimated and signed.
Hard to fabricate consistently with the optical flow of the frames it accompanies.
Raw audio
Uncompressed LPCM master alongside the delivery file.
Delivery codecs filter exactly the frequencies forensic work needs. Capture it now or lose it.
Shutter burst
A short ring of frames from around the shutter moment.
Supports parallax and display-beat analysis. Shows the seconds either side of the frame you kept.
Face check
Whether an OS biometric check passed at capture start.
A boolean. No face geometry, template or image is recorded or transmitted.
Transcript
On-device speech recognition of captured audio.
Never leaves the device. Strippable from shared copies at byte level.
Byline / org
Author name and affiliation.
Off by default. Always stripped from de-identified copies.
Location
GPS fix and accuracy radius at capture.
Civilian GNSS is unauthenticated. A lead for a desk to corroborate, never proof of place.
Wi-Fi
The SSID and BSSID the phone reports joining.
Anyone can name an access point anything. Signed as a lead; BSSID lookup happens desk-side.
Things I have not built yet
Android. StrongBox gets closer to the sensor than the Secure Enclave allows, and the platform exposes sensors iOS keeps to itself: raw barometric pressure, per-frame camera timestamps, a real multi-camera API. Anything committed there would be stronger than the same claim made here.
LiDAR. Pro iPhones ship a depth scanner and nothing uses it for provenance. A sealed depth map answers the flat-screen question directly rather than inferring it from disparity, and it works in the dark.
Altitude against terrain. Every capture already seals a barometric altitude, and nothing checks it against the ground elevation of the coordinate it claims. A GPS spoofer does not reach the barometer, so the two disagree by however far the lie moved you. It is arithmetic rather than image interpretation, which makes it the rare check a reader can act on without knowing anything about photography.
Wi-Fi networks against a public location database. The network the phone was joined to is already sealed. Access point identifiers are broadly mapped by public wardriving projects, so a sealed network that lives four thousand miles from the sealed coordinate is a contradiction sitting in plain sight. Today that is a lead a desk has to follow by hand.
Authenticated satellite positioning. Galileo began signing its navigation messages in 2025, which for the first time makes a position something a receiver can check rather than merely believe. Phones do not expose that to apps yet, and iOS hands over a finished coordinate with none of the raw material behind it. This one is waiting on the platform, not on the idea.
Optional face blurring that survives the signature. A redaction committed at capture — the blur applied before signing, the original never written — would let someone publish a crowd without publishing the crowd's faces.
More ways to catch rephotography. Moiré from a display's pixel grid, the refresh beat of a panel against a rolling shutter, the polarization signature of an LCD.
PRNU checks. Every sensor leaves a fixed noise fingerprint. The useful signals are blunt ones: a frame carrying two fingerprints has been composited from two cameras, and a frame carrying none never came off a sensor at all. Neither needs a reference corpus to flag.
Soft binding, and formats that outlive the file. The perceptual fingerprint is already committed. What is missing is somewhere to look it up.
Prove your work.
On January 1, 2027, all across the internet, the lights go on. California will require every platform with more than two million monthly users in the state to surface provenance data in what its users post, and from 2028 every camera and phone sold in the state must embed it by default. Content Credentials stop being something you can go and check and become something you are shown. Whatever fraction of the internet is carrying a manifest becomes visible in a single day, and nobody knows yet whether the room turns out furnished or bare.
Most of what is out there will have nothing to show. An interface that displays a credential also displays its absence, and absence is the easiest thing in the world to misread. A photograph with no manifest is not a lie. It is a photograph taken on an older phone, or run through an editor that dropped the metadata, or sent by someone with good reasons not to carry a record of where they were standing.
Which leaves the question the art dealers never solved either. A file can arrive with a spotless history and still be a picture of cardboard fairies on hatpins, and nothing in the record will say so. Provenance establishes that a file is what it claims to be. The harder question goes back to a person, where it has always been — the jury, the journalist, and the reader.
Source Kit does not solve misinformation. What it offers is narrower: a way for an honest photographer to show their work, and one more expense for everybody else.
