What ChatGPT puts in your images: content credentials, and when they survive

By The NeutronField editorsPublished Updated

Checked on 2026-11-02 with c2pa-rs (c2pa-python) and a PNG chunk reader

Short answer

OpenAI says every image made with ChatGPT, Codex or its API carries two records: a signed C2PA content credential and an invisible SynthID watermark. Our API file had the credential, signed by OpenAI, and nothing else: no text fields and no prompt. Saving or sharing the file strips the credential; the watermark is built to last longer.

Evidence order

Strongest first
  1. Signed content credentialOpenAI signed it; it records the tool and a watermark step.Present
  2. Metadata fieldsNo text chunks or EXIF outside the credential.Absent

Status on the test file in frame 31, a PNG from OpenAI's image API.

Our file test

One PNG from OpenAI's image API, read chunk by chunk before any conversion.

frame 31Frame 31, the test file: a blue and white bowl of lemons on a blue tiled counter by an open window
▸ 31NF 07 · TEST FILE

What frame 31 carries

SignalYesNo
Content credentialmarkednot marked
Metadata fieldsnot markedmarked
Prompt saved in filenot markedmarked

Checked on 2026-11-02 with c2pa-rs (c2pa-python) and a PNG chunk reader. The signature and file hash match; our tool does not carry OpenAI's certificate in its default trust list, so it labels the credential untrusted rather than verified.

Fields read from frame 31, a 1536 by 1024 PNG returned by OpenAI's image API on 2026-11-02.
FieldPresentValue
C2PA manifestYesIn a caBX chunk; signed by OpenAI Media Service (OpenAI OpCo, LLC)
Claim generatorYesOpenAI Media Service API
Actions recordedYescreated (software agent: API, gpt-image); converted; watermarked
Digital source typeYestrainedAlgorithmicMedia (IPTC)
tEXt, iTXt, zTXt, EXIFNoNone in the file
Prompt textNoNot stored anywhere in the file
Raw output excerpt · c2pa-rs
claim_generator_info: OpenAI Media Service API, spec 2.2.0
signature: OpenAI OpCo, LLC, OpenAI Media Service, 2026-11-02T05:32:53Z
c2pa.created: softwareAgent API / gpt-image, trainedAlgorithmicMedia
c2pa.converted: 2026-11-02T05:32:53Z
c2pa.watermarked.unbound: 2026-11-02T05:32:52Z
assertion.dataHash: match
signingCredential: untrusted in default settings (no trust list loaded)

Where the credential is written

A content credential is a signed record that travels inside the file. OpenAI uses the open C2PA standard for it (C2PA specification 2.2), and its help centre says images generated with ChatGPT, Codex and the API include both C2PA metadata and SynthID watermarks (OpenAI Help, C2PA and SynthID).

In our PNG the credential sits in its own chunk, called caBX, between the header and the image data. It names the signer as OpenAI Media Service, says the image was created through the API by gpt-image, and lists two more steps: a conversion and a watermark being applied. The image data hash in the credential matched the file, which means the pixels have not changed since OpenAI signed it.

What the file does not hold is just as telling. There are no text chunks, no EXIF block and no copy of the prompt. If you need to remember how you made an image, keep your own note; the file will not do it for you.

What survives sharing

Very little of the credential survives an ordinary save. When we opened our PNG and saved it again as a JPEG, the credential was gone: our tool found no C2PA data at all. The same happens when a chat app, a social feed or a design tool re-encodes the image on upload, and to any screenshot.

OpenAI's own documentation says as much: editing, converting or sharing a file can remove its metadata, while the SynthID watermark is part of the image and is meant to persist through some edits (OpenAI API docs, content provenance). So the original download is the copy worth keeping. A re-saved copy can still carry the watermark, but only a detector can tell you that.

Images from the API, and from ChatGPT

Our test file came from OpenAI's image API, not from the ChatGPT app. OpenAI describes the same two records for ChatGPT downloads, but a file saved from the ChatGPT app can differ in format and in what the app adds, so we will publish that download as its own test rather than assume it matches.

  1. Keep the original file you downloaded, not a screenshot or a copy saved from a chat.

  2. Open a content credential viewer such as Content Credentials Verify and load the file. An OpenAI image shows OpenAI as the signer and a created action.

  3. For the watermark, OpenAI points people to its own verification page, which looks for SynthID and for a trusted OpenAI credential.

  4. Write the date and the result next to the file. Results change as tools change, and a dated note is what makes them useful later.

What this can and cannot prove

A credential that matches its file shows that OpenAI signed a statement about it and that the pixels are unchanged since. It does not tell you who wrote the prompt, whether the picture was edited later in another tool, or whether other copies exist. A copy without a credential proves nothing either way; OpenAI's documentation says a missing signal is not proof that content was made by a person.

For the same test on Google's models, see Gemini and Nano Banana images; for every generator we have tested, the Made with AI hub, and for our method, the About page; and for edits to real photos, edited with AI.

A missing label does not mean an image is human-made.

Sources

  1. OpenAI Help: C2PA and SynthID in OpenAI-generated images (accessed 2026-11-02)help.openai.com
  2. OpenAI API docs: Content provenance (accessed 2026-11-02)developers.openai.com
  3. C2PA Technical Specification 2.2 (accessed 2026-11-02)c2pa.org
  4. Content Credentials: Verify (accessed 2026-11-02)contentcredentials.org

Questions

Does ChatGPT add a watermark to images?

Not a visible one in the files we have seen. OpenAI says images from ChatGPT, Codex and its API carry an invisible SynthID watermark and a signed C2PA content credential. Our API file had the credential, which also records a watermark step.

Does a ChatGPT image save my prompt?

No. Our file from OpenAI's image API held no text fields and no copy of the prompt. The credential records the tool and the steps, not what you typed.

Does the credential survive sharing?

Usually not. Re-saving our PNG as a JPEG removed it completely, and OpenAI says editing, converting or sharing can strip metadata. The SynthID watermark is designed to last longer, but only a detector can confirm it.

Do DALL-E images have the same records?

OpenAI's current help article covers images made with ChatGPT, Codex and the API. Older DALL-E files may differ, so check the file itself with a credential viewer.

Why does a viewer call the credential untrusted?

A viewer only trusts signers on the certificate list it loads. Our tool's default settings did not include OpenAI's certificate, so it confirmed the signature and file hash but marked the signer untrusted.

Related reading