Metadata gets stripped or forged. OIM signs the bytes of the image with ECDSA: if someone alters it, it stops being shown. This is how digital signatures for images work and how their authorship is verified.
A screenshot of a bank statement, a chart with the quarter's sales, the official poster of an event. Every day we receive images and assume they tell the truth. But changing a figure or a name in an image takes seconds, and the result is indistinguishable from the original.
The usual answer is the label: "made by", "date", "camera". The problem is that those labels can be deleted or rewritten without touching a single pixel, and almost every social network strips them when the photo is uploaded. A label anyone can change proves nothing.
An example: the chart that circulates without its source
Imagine a sales chart someone receives by message. It says sales rose 12 %. Before sharing it, they want to know whether that is the figure the company published. With a text label there is no way to check: text can be edited.
With a signature the check works differently. The viewer recomputes the seal over the content it has in front of it. If the figure says 12 % but was published as 21 %, the signature does not match and the image is not shown. You do not have to trust whoever sent it.
A seal that breaks if touched
Every OIM file is signed when it is exported. The signature works like the wax seal on a letter: it does not stop anyone opening it, but if someone opens it and closes it again, you can tell.
What matters is what the seal covers. It is not a label stuck to the side: it covers the piece's data, its texts, layers and animations, and the base image too. Changing a number, a colour or a pixel breaks the signature. If the PNG is recompressed without changing any pixel, the file is no longer the one OIM produced, because its internal image stream changes.
Checking it does not depend on anyone
Many verification systems work by asking a central server whether the file is valid. That has two weaknesses: if the server goes down, nobody can check anything, and the server also learns who looks at each file and when.
In OIM the check is done by the viewer itself, on the reader's device, when the file is opened. It uses the public keys it already carries. It asks the key directory only when the file was signed with a key it does not carry, or when the embedded key fails and it retries with the published one.
If the signature does not match, the image is not shown.
Which states a piece can have
Each document declares who may edit it again. There are three:
solo_autor(the default): only the account that created it can publish new versions under that identifier.publico: anyone can open it, modify it and export it again under the same identifier.sellado: the piece is closed for everyone, including its author. There is no going back.
If a file declares an unknown value, the viewer treats it as solo_autor. It never falls back to publico.
Trust should not be a promise. It should be something you can check.
What each party gains
- The publisher knows the piece will not circulate altered under their name.
- The reader knows what they see is what was published.
- Anyone who wants to check can: the method is public and the signature uses an open standard (ECDSA on the P-256 curve).
What the signature does not do
To be clear: the signature proves that the file has not changed since it was signed. It does not prove that its content is true. It is a guarantee of origin and integrity, not a lie detector. But it is exactly the missing piece for knowing, at least, where an image comes from.
How to start
- Load the player and declare the image. If the file is signed, the viewer checks the signature without you doing anything else:
<script src="https://cdn.oim.media/player/v1/oim-player.js"></script>
<oim-player src="sales-chart.oim.png" lang="en"></oim-player>
- To check the result in your own code, the documentation includes verification examples in the browser and in Python. Start with the quick start guide.
If your image also uses brand colours that change with the theme, read images that adapt to dark mode without duplicating.
Frequently asked questions
Does the signature prove that a photo is real?
No. It proves that the file is the one that was signed and has not changed. If the photo shows something false before it is signed, the signature protects that falsehood just the same.
What happens if I recompress the PNG?
The seal breaks, even if you change no pixels. That is why it is best to distribute the file exactly as OIM produced it.
Can someone else modify my .oim?
It depends on its state. With solo_autor, only your account can publish a new version. With sellado, nobody can.
Do I need a connection to verify a signature?
The viewer keeps the keys it has downloaded in the browser (IndexedDB).
Further reading
- What is a .oim: an interactive image inside a PNG, to understand the container that gets signed.
- Multilingual images: one PNG for ten languages, to see what the signature protects in a piece with several texts.