The Birthmark Standard Foundation

Bringing back “pics or it didn’t happen”

Prove a photo came from a real camera, without exposing who took it.

AI-generated images have made "does it look real?" an unreliable test. Platforms strip the metadata that was supposed to answer it. The Birthmark Standard moves the proof out of the file and into a public registry.

I want to take photos that people will believe

Register a photo when you take it. Your photo stays with you, and the record carries no name or location.

See how registering works →

I want to know what photos are real

Find out whether a photo came from a registered camera, and whether it was edited afterward.

See how checking works →

I want to help run the registry

Journalism and fact-checking organizations can advise now and run a Registry Node when ownership opens.

See how to get involved →

How it works

A registered camera computes a fingerprint of each photo. The registry records the fingerprint, a verdict on how the image was processed, and a coarsened time. The registry never receives the photo, and no single system sees both who took it and what it shows. Anyone with the file can check it.

See how it works →

The fingerprint

Change one pixel and the whole fingerprint changes. A record matches only an exact copy of a file.

ORIGINALONE PIXEL CHANGED1 pixelSHA-256SHA-256Fingerprint begins1448a4c9f9257a7a ...Fingerprint begins34ffc52b3ec0904c ...≠Change one pixel and the whole fingerprint changes.
The same 16 by 12 pixel picture twice, with one pixel changed. The fingerprint is the real SHA-256 of the picture's pixel values, drawn as an 8 by 8 pattern from its first 64 bits. A record matches only an exact copy of a file.

What a record proves

  • The file came from a registered capture device.
  • How the image was processed after capture.
  • Roughly when it was registered.

What a record does not prove

  • That the scene is true. Staged scenes and photos of screens pass.
  • Anything about a photo from a manufacturer that does not participate. A missing record is not evidence of fakery.
THE SCENECAPTURECERTIFIED EDITANY OTHER CHANGENot coveredA record cannot saythe scene is true.Staged scenes andphotos of screensstill pass.CoveredA registered camerarecords a fingerprintof the file, how itwas processed, androughly when.Covered, weakerCertified softwarewrites a new recordlinked to the original.It relies on thedeveloper's judgment.Record lostA re-save, crop orscreenshot makes anew file with norecord. Only an exactcopy of a registeredfile matches.
A photo's life from the scene to later changes. A record covers capture, covers certified edits with a weaker guarantee, and does not cover the scene or any other change.

Status

The protocol is specified, formally modeled and simulated. Twelve security properties are machine-checked across eleven ProVerif models. An earlier design ran on a Raspberry Pi 4 prototype.

Next: a reference implementation on camera-class hardware, then a pilot with journalists and photographers. Journalism and press-freedom organizations will operate the registry once it launches.

Read the papers →  ·  Contact