Prove a Photo Wasn't Edited: How Tamper-Evidence Works | Prooflens

The short answer

A photo cannot testify about itself. A plain JPEG carries nothing that records what it looked like at the moment the shutter fired, so "was this edited?" has no answer inside the file — it becomes an argument about whose word you believe. Prooflens closes that gap by making each capture carry its own evidence: a local SHA-256 hash computed on your device, an RFC 3161 timestamp signed by an independent authority, and a Bitcoin anchor through OpenTimestamps. Change the file and the hash no longer matches, and because that mismatch is arithmetic rather than opinion, the disagreement ends. None of it requires trusting the app, or any company: verification runs on-device, and an anchored proof can be checked by anyone holding the file.

Prooflens is on the App Store. The rest of this page is about what a proof does and does not cover, because the confusion in this space comes from tools claiming more than a hash can deliver.

why the searcher is here

The question almost never arrives on a calm day. It arrives when a photo has already mattered — a contractor disputes the timeline, an insurer asks what was documented when, a client says the damage looks different in the file they were sent — and by then the only artefact is the file, which anyone holding it can modify, including the person who is being asked about it.

So the real problem is not "can I detect edits." It is that nothing in a photograph is a record of itself. EXIF timestamps are fields in a file anyone can edit. A screenshot of a cloud receipt is a picture of a claim, not the claim. Even a correctly timestamped photo is worthless if the person presenting it built the evidence.

What makes edits hard to argue about is a reference that existed before anyone had a reason to change anything. That is the whole idea, and everything below is a detail of it.

What a hash proves — and the one thing it can't

A SHA-256 hash is a fixed-length digest computed from the bytes of a file. Change any byte and the digest changes completely, so the hash stands in for the file's exact contents in a fraction of the space. The digest is one-way: the original image cannot be reconstructed from it, which is why sending it is not the same as sending the picture.

The property that is easy to over-read is this: a hash detects change relative to a reference that already exists. It cannot, on its own, tell you a file is authentic. Someone who edits a photo and then computes a new hash has a perfectly matching hash — nothing breaks. The proof only holds if the hash was computed at capture, by the app that took the shot, before anyone could have reason to touch it.

That gap is not hypothetical pedantry. It is exactly the attack the second and third layers exist to close, and it is why "just hash your photo" is not an answer.

Why three layers rather than one

Each layer answers a different question, and the questions stack:

• The SHA-256 manifest answers has this file changed since the moment it was captured?
• The RFC 3161 timestamp answers when did that hash exist? — signed by an independent authority, which is what removes "the person who made the hash also chose the moment it claims."
• The Bitcoin anchor via OpenTimestamps answers can the timestamp itself be rewritten? Anchoring publishes a commitment to the timestamp into a public blockchain, so it cannot be backdated or silently replaced.

Together they turn "trust me" into three separately checkable statements. Hashing alone proves a file has not changed since an unknown moment in an unknown history; the timestamp fixes the moment; the anchor fixes the timestamp.

Worth noting on cost: OpenTimestamps is a free, open protocol, and many proofs are aggregated into a single Bitcoin transaction rather than one per photo. Anchoring therefore carries no per-proof cost to you — the free-versus-paid question belongs to Prooflens Pro's tier, not to the chain.

What the recipient has to do with it

Evidence only counts if the person receiving it can check it without taking your word for it. Two mechanics make that possible.

The evidence library keeps every capture with its on-chain anchoring status, so you can see at a glance which items are anchored and which are still pending. That distinction is not cosmetic: a capture with a local hash is already tamper-evident, but it has no third-party time and no public record until the timestamp and anchor land.

Verification runs fully on-device, so you can check someone else's Prooflens evidence yourself rather than relying on the app that produced it. For anything you need to hand over, Pro exports a .zip plus a PDF legal statement describing the evidence and its anchoring status — the receiving party reads a description instead of reverse-engineering a hash. That path has its own page: court-admissible photo evidence.

Only the SHA-256 hash ever leaves the phone. Photos are captured, watermarked and hashed on device and never uploaded — no account, no tracking, no cloud backup. If a proof has to circulate without identifying your handset, Prooflens can also produce anonymous evidence with the device serial stripped.

the edges that matter

The honest limits, stated before you rely on them:

• It is offline-first, not offline-complete. Capture, watermarking and hashing work with no connection. The RFC 3161 timestamp and the blockchain anchor do not — when you are offline, those proofs queue locally and complete automatically once you are back. An item pending in the library is genuinely not yet anchored, and the status display exists so you can tell.
• The proof covers the file's bytes, not every copy of it. A photo that is re-compressed or re-encoded by whatever app carries it to a customer arrives as a different byte stream, with no bad intent involved. Hashes are what let you distinguish an intentional edit from an ordinary transfer.
• The watermark is legible, not load-bearing. It makes a capture self-describing to a person — date, time, GPS, altitude, project and notes — but it can be cropped or edited. The cryptographic proof is the hash, timestamp and anchor. See burning GPS and details into a photo.
• It proves a file has not changed, not what the file depicts. Nothing here establishes that the situation shown was lawful, or that the photo was taken where it claims. It is technical evidence, not legal advice, and whether a given court or counterparty accepts it depends on that jurisdiction's evidentiary rules.

what Prooflens does differently

Most tools in this space sit at one of two extremes: a hash utility you run by hand afterwards, which proves nothing about when, or a cloud notarisation service, which works precisely because your photo is uploaded somewhere you do not control.

Prooflens takes the third position. The same app that takes the shot computes the hash, which closes the gap between "the file I photographed" and "the file I hashed" — the gap that makes a hand-run hash worthless. It then adds a third-party timestamp and a public anchor by default rather than leaving them to a separate tool, and keeps the whole verification path on-device so the check never depends on trusting the producer.

The honest limits of that position: Prooflens Pro is the tier that carries unlimited proofs and unlimited blockchain anchoring, all watermark templates, .zip export and the PDF legal statement, on an annual subscription with a 7-day free trial or a one-time Lifetime purchase. And the product is currently listed as in development, so if you are evaluating it, verify the behaviour against the build you are actually handed.

the decision this leaves you with

The question "can I prove this photo wasn't edited?" splits cleanly in two, and it is worth being clear about which one you are asking. Did the bytes change after capture? is answered completely and cheaply by a hash taken at the shutter. When did it exist, and can anyone verify that without believing me? needs a third party, and that is the layer most tools skip.

Prooflens answers both, on a phone, without uploading the photo. If you need to hand evidence to someone who will not take your word for it, that is the case it is built for — the on-device verification and the optional PDF statement are what make the difference at that moment.

The case it is not for: showing what a photo depicts, or getting a legal ruling. It produces evidence and a description of that evidence. Everything beyond that is someone else's judgement.

Get Prooflens on the App Store — or read how court-admissible export and the forensic watermark fit in first.