How to check whether an image was altered

An image reaches you by email. It claims to be a photo of a contract, a poster for an event or an approved design. How do you know someone did not change it on the way? And, harder, how do you know what it shows is true?

These are two different questions. One is about integrity: is the file the one that left its source? The other is about truth: is what it says correct? A file can be intact and still lie. This guide covers the first question, which a signature can answer, and makes clear where it stops.

Integrity is not truth

Think of a printed receipt with a stamp. The stamp proves nobody touched the paper after it was stamped. It does not prove the price is fair or that the shop exists. An image works the same way.

In an .oim, the ECDSA signature covers the document data and the base image. If you change a text, a colour or a pixel, the check fails. But the signature does not say who made the image, and it does not say the content is true. The security guide puts it in one sentence: the signature guarantees that the document data has not been altered since OIM packaged it, and that it passed through our sanitiser. Nothing more.

What is removed when packaging

An original file carries things you may not want to share: comments, camera data, the GPS position of a photo. When an .oim is created, the compiler discards the existing text chunks of the original PNG (tEXt, zTXt and iTXt). If the input is a JPEG, it also discards its EXIF. So the .oim does not carry that data.

The file also does not carry the author's identifier. That is personal data, and sealing it into a file that gets distributed would make it impossible to delete later. It lives in a registry that can be corrected. That is why the signature does not tell you who made the image.

What it does not detect

There are limits you should know:

• Steganography. If someone hides a message in the least significant bits of the pixels, that message travels with the file. The signature covers it as part of the document, but does not inspect it. Reliable detection of that kind of hidden message is not possible today, and the guide does not promise it.
• Files not made by OIM. The signature only proves something about files signed by OIM.
• Recompressed images. If you re-save the PNG without changing any pixel, the image bytes change. The signature notices, even though the picture looks the same.

What the results mean

The security guide and the ECDSA guide describe these states. A tampered file is not shown, neither its image nor its layers:

Result	What it means	Shown?
Valid signature, image matches the seal	Intact	Yes
Valid signature, no image seal (files before 11 September 2026)	Signed, image not sealed	Yes, with a notice
Valid signature, but the image does not match	The image was changed	No
Invalid signature	Data altered or forged signature	No

An everyday example: someone opens your .oim in a program, saves it again with different compression and sends it back. No colour changed to the eye. For the player, the image is no longer the one OIM produced, so it does not show it.

How to check with the player

The most direct way is <oim-player>. The getSecurityStatus() method returns the signature state:

const player = document.querySelector('oim-player');
const status = player.getSecurityStatus();
console.log(status); // the signature state

How to check without the player

The public key is published as a JWK set, at this address:

GET https://api.oim.media/v1/media/keys

Each signature names its key through the key_version field, which matches the key's kid. With that key, the ECDSA guide shows how to verify in the browser with the Web Crypto API, and includes an equivalent Python script. Both rebuild the canonical data first, without the signature, key_version, timestamp and creator_user_id fields, and then check the 64-byte IEEE P1363 signature.

If you write your own .oim reader, the rule is the same one the player applies: verify the signature before using anything from the document, and sanitise the content before inserting it into the page.

A short list for everyday use

1. Use the original .oim.png file, not a screenshot or a forwarded copy.
2. Open the file on the web with <oim-player> and look at the signature state.
3. If the state is invalid or the file does not appear, do not trust it.
4. If the state is correct, remember that it only confirms integrity. For truth, find the source.

For the principle behind it, read the signing protocol on every pixel. For the idea that the image carries its own description, read the image that knows what it is.

Frequently asked questions

If the image looks the same, does that mean it was not altered?

Not necessarily. A change can be invisible to the eye and still change the bytes of the file. For an .oim, the question is whether the signature matches, not whether the picture looks the same.

Is an unsigned file fake?

No. It means it is not signed by OIM. It can be an ordinary PNG, or an .oim from before the image seal. The unsigned state only says that.

Why does my image not show if it is fine?

If the state is image_mismatch or invalid_signature, the player shows nothing from the file. The most common cause is that it went through a tool that recompressed the pixels. Ask for the original file.

Does this stop someone from copying the image?

No. The signature does not control who copies or uses the image. It proves the file is the one OIM produced and has not changed. Whoever copies it gets the same copy.