Skip to content
Qamera AI
Try for free

Check a signed report

Someone handed you a signed report from our image check. Here is what it says, and how to test it against the file.

Paste or open the report file. Its signature is checked here, in your browser, against the keys this site publishes. You can also add the image the report is about — the fingerprint is compared and the whole check runs again, so you get your own answer beside the recorded one.

The report records what our checker reported in someone's browser. Qamera never received the file and did not confirm the result, which is why re-running the check matters.

A file ending in .jws, or its contents pasted above.

What a signed report does and does not establish

It fixes one answer to one file, at one moment, under a named checker version and trust list, in a form nobody can edit afterwards. It does not establish that we inspected the file: we never received it, and the findings are what a browser reported.

Keys are rotated over time and every key we have ever used stays published. A report signed by a retired key still checks out — an expiring record would be no record at all.

You do not have to use this page. The report is a standard JWS: any JOSE library can check it offline against the keys published at: /.well-known/jwks.json

Our signing keys, printed here on purpose

These are the public halves of every key we have ever signed a report with. They are also served at the address above, but a report is meant to be checkable for years — and an address only works while this site does. Printed here, a copy travels with anything you save or archive.

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "KePO_zGTvDsyern7fHCvCRr3XiLVdwTXMQpE140RCCw",
      "y": "m3UTes6FfCYXcimE7oDvcIz4rS4ebi2NslXt4qTTWO8",
      "kid": "ZCNbFBy3RRPmNjjYmGuy3tVMh2d-ec9We0vycTykDDI",
      "use": "sig",
      "alg": "ES256"
    }
  ]
}

To check a report yourself: decode its header, take the kid, find the matching key below, and verify the ES256 signature over the first two segments. The fingerprint in the payload is a plain SHA-256 of the file, so sha256sum, certutil -hashfile or Get-FileHash will reproduce it.

See also

The rest of the AI image labelling set.