The local-only boundary
Selecting, dropping, or pasting a supported image gives browser code temporary access to that file. jpeg.id checks the image in memory and creates local previews, normalized reports, comparisons, and downloads. None of that file-derived data is sent to jpeg.id, Cloudflare, a parser service, an analytics provider, or a remote certificate service.
Normal web hosting still requires your browser to request the public application. Same-origin requests fetch HTML, JavaScript, CSS, fonts, WebAssembly, workers, reviewed trust snapshots, icons, and a sample only after you select it. As with any website, hosting infrastructure receives ordinary HTTP request information for those public resources, such as IP address, request time, path, and browser headers.
Data jpeg.id does not collect
- Image bytes or local previews.
- Original or normalized filenames.
- SHA-256 hashes or detected image dimensions.
- C2PA manifests, signer details, declarations, or validation reasons.
- EXIF, IPTC, XMP, location, camera, creator, or software fields.
- Comparison rows, JSON reports, text summaries, or standalone HTML exports.
- Accounts, profiles, saved history, analytics events, or advertising identifiers.
Network and browser controls
Remote C2PA manifest fetching and online certificate status checks are disabled. Runtime dependencies and fonts are self-hosted. The application uses no remote CDN, analytics beacon, persistent browser storage, service worker, WebSocket, or backend. A strict Content Security Policy limits connections and executable resources to the jpeg.id origin and prevents framing or form submission.
Browser workers isolate long-running parsers from the interface and are terminated on timeout or cancellation. They improve responsiveness and cleanup; they are not presented as a security or network sandbox.
Limits of this promise
jpeg.id cannot control browser extensions, a compromised browser or operating system, device malware, enterprise monitoring, network infrastructure, or how an operating system handles clipboard and file-picker activity. JavaScript memory does not provide forensic erasure guarantees. Downloading, copying, printing, or sharing a report intentionally moves its contents beyond the application boundary.
A report can contain a filename, full file hash, GPS value, creator identity, timestamps, and manifest declarations. Review exported data before sharing it.
Security and trust trade-offs
Local verification avoids transmitting private media, but an offline trust snapshot cannot learn about a newly published revocation until jpeg.id is updated. The report therefore records snapshot identity, and the interface distinguishes valid integrity from recognized signer trust.
Read how validation and cleanup work, or review what each result can establish.