Everything runs in the browser from static files, the heavy parts in a Web Worker. Close to 30 checks per file.

Content Credentials (C2PA) are parsed from the JUMBF boxes and verified with WebCrypto: COSE_Sign1 signature (ECDSA P-256/384/521, RSA-PSS), each assertion hashed against the signed claim, the file hash binding, and the certificate chain walked to a vendored copy of the C2PA trust list. Not checked: revocation, signing-time timestamp, key-usage policy.

Pixel side: quantization tables against the libjpeg standard set, double-quantization periodicity in the DCT histograms, JPEG ghosts, error level analysis, noise map, block-based copy-move. Two heavier ones run on demand. A transformed clone search: FAST-9 corners with Harris ranking spread over 64 px cells, 8-level pyramid, 256-bit steered BRIEF, similarity RANSAC binned by angle and scale, a second pass against the mirrored image, patch correlation after the fit. A local noise comparison: trimmed mean of the Laplacian residual per 32 px tile against tiles of the same brightness and texture class elsewhere in the image. Two versions of a photo can be compared; alignment tries correlation first, then the feature matcher, so crops, resizes and rotations line up.

Limits: no AI detection claims, because without credentials nothing reliable exists. The two on-demand methods are experimental and unscored: tuned on planted edits, not yet measured on a real-photo corpus. Repeated real objects match like clones, and the card says so. 24 MP cap, 16 MP for the noise comparison. Findings are things to look at, not proof either way. Vanilla JS, no framework, no CDN.

One of the client-side tools on vajba.com, built with Claude Code. No ads, no tracking.

> Finds clues worth investigating, not proof that a photo is edited or authentic.

Isn’t this kind of Claudeslop something you could at least remove from the homepage of a product like this? What does this even tell me? Nothing! It tells me the person who created this site had no opinion about what it should actually do, and just let their LLM agent building something that vaguely fits their impression of what could be done to detect image tampering.

I dropped an image that was color corrected with AI, but otherwise a proper image of myself. I use my own face because it's very easy to see if AI has altered it in a subtle way when dealing with a very familiar subject.

It found the "AI Generated" signature embedded in it by the creator (whatever image model Perplexity decided to use.)

But I wouldn't have called this image AI. So images that have merely been color corrected or other very minor changes may come up as "AI Generated" even if they're essentially real images.