A plain-language account of every protection method Make & Protect can apply. For each: who provides it, what data is transmitted, whether your original is ever sent anywhere, what it can and cannot do, and whether it is included or optional. This page is updated whenever providers change.
Cryptographic hash (SHA-256)
IncludedProviderBuilt in — computed in your browserPurposeIdentify this exact file with a unique digital identifier.What is transmittedNothing. Computed locally on your device.Original sentNoClaimed resilienceAny change to the file produces a completely different hash.Known limitationsIdentifies the file, not the image. Does not prevent copying or detect visual similarity.Perceptual fingerprint
IncludedProviderBuilt in — computed in your browserPurposeRecognize visually related versions of an image even when the exact file has changed.What is transmittedNothing. Computed locally from a downscaled copy.Original sentNoClaimed resilienceTolerates resizing and minor edits. Less tolerant of heavy cropping or recoloring.Known limitationsA coarse fingerprint, not a forensic match. “Possible match” — never “theft detected.”Rights metadata (IPTC/XMP)
IncludedProviderBuilt in — recorded in your protection recordPurposeRecord creator and copyright information alongside the work.What is transmittedNothing. Metadata is recorded in the receipt and record.Original sentNoClaimed resilienceMetadata survives in files that preserve it, but many websites and platforms strip it on upload.Known limitationsNot durable protection on its own. Embedding directly in the file is not yet supported in the browser.Visible mark
IncludedProviderBuilt in — rendered in your browserPurposeApply a visible watermark or corner mark to a sharing copy.What is transmittedNothing. Rendered locally onto a derivative.Original sentNoClaimed resilienceDeters casual reuse. Can be cropped or removed by a determined editor.Known limitationsAffects presentation. Applied to the derivative only — your master is never altered.Protected web derivative
IncludedProviderBuilt in — rendered in your browserPurposeCreate a sized-down, web-ready copy with protections applied.What is transmittedNothing. Generated locally.Original sentNoClaimed resilienceKeeps your master private. The derivative is what you share.Known limitationsA smaller copy — not a substitute for the master.Invisible watermark
OptionalProviderExternal (not yet connected)PurposeEmbed a machine-detectable identifier that can survive resizing, compression, and cropping.What is transmittedA search derivative would be sent to the provider — never your master.Original sentNoClaimed resilienceMore resilient than visible marks, but survivability depends on the provider and how the image is altered.Known limitationsNever universal. Provider-dependent. No provider is connected today.Content Credentials (C2PA)
OptionalProviderExternal (not yet connected)PurposeAttach signed provenance information that documents origin.What is transmittedSigned metadata would be attached to a derivative.Original sentNoClaimed resilienceDocuments origin verifiably where supported. Does not prevent copying.Known limitationsBrowser-based signing is not yet supported. Verifiers must support C2PA.Independent timestamp
OptionalProviderExternal (not yet connected)PurposeTimestamp the cryptographic hash with a trusted service so evidence persists independently.What is transmittedOnly the hash and timestamp request — never the image.Original sentNoClaimed resilienceEvidence survives even if this service disappears.Known limitationsNo provider is connected today. We encourage independent timestamps for long-term evidence.If an external provider is retired or changes, historical records remain intact and are never rewritten to imply a different technology was used. See the protection policy for how provider changes are handled.