Does ChatGPT Watermark Images? Yes, and You Can Verify It in a Browser

Two marks, one file, and for once a check you can actually run. That is the whole ChatGPT image story as of September 14, 2026, and it is a different story from ChatGPT text, which carries no watermark at all.

What is in a ChatGPT image

Since May 19, 2026, every image generated in ChatGPT, through the API, or in Codex carries two separate signals.

The first is SynthID, Google DeepMind's pixel watermark, which OpenAI licenses and embeds in the image data itself. It is invisible, it is not a logo, and it is designed to survive the things people assume will defeat a watermark: screenshots, JPEG re-encoding, resizing, cropping, and light edits.

The second is a C2PA manifest, better known as Content Credentials. It is a signed block of metadata inside the file that records which tool produced the image and when. OpenAI signs it with its own certificate, so a reader can check that the manifest is intact and that OpenAI issued it.

The two live in different places and have different fates. The manifest is metadata, so anything that strips metadata removes it, including most social platforms on upload, a screenshot, and the image metadata remover on this site. The pixel mark is in the picture, so none of that touches it.

How OpenAI's verifier works

OpenAI runs the only public check for its own marks. There are two doors to it: a Verify tool for people, and the Content Provenance API for software. Both take the image, look for the SynthID pattern OpenAI embeds, and validate the C2PA manifest against OpenAI's signing keys. Both return the same two answers: was OpenAI's SynthID detected, and is there an OpenAI-issued manifest.

That scope matters. The verifier reads OpenAI's signals with OpenAI's keys. It does not read Google's Gemini key, Adobe's certificates, or anyone else's watermark. It is a provenance check for one provider, not a general "is this AI" oracle.

Running the check from DetectMark

DetectMark can run that check for you with one consent click. Here is the exact sequence, because the exactness is the point.

1. Drop a PNG, JPEG or WebP into the image tool. The local scan runs first, entirely in your browser: Content Credentials, EXIF, XMP, GPS and PNG text chunks are parsed and listed, and the pixel-watermark row reads Unknown, because no browser can read SynthID.
2. Below the local result, a panel offers to send the file to OpenAI. It names the file, states the exact byte count, names the destination (api.openai.com), and says that only the original file will be sent. Nothing has left your machine at this point.
3. Click Verify with OpenAI, and a dialog repeats those facts and asks you to confirm. Cancel, and nothing is sent. Confirm, and the original file goes to OpenAI through DetectMark's relay, which adds the API key and forwards the bytes without storing them.
4. Two rows come back, each with a Clean or Found badge and a note: the SynthID result and the Content Credentials result. A footer records that OpenAI did the check and when. The privacy counter in the scanner header now shows the bytes that were uploaded, because they were.

Two rules never bend. The check never runs automatically, and it never runs on a cleaned copy. OpenAI's terms forbid using the verifier to test whether a removal worked, and DetectMark does not want to be the tool that does it anyway. If you strip the metadata and ask to verify, the offer is gone.

The OpenAI image verifier page puts that flow first and the local scan second. The AI image watermark detector does the reverse. Same engine, same consent gate, different emphasis.

What the check does not cover

That single sentence rules out most of the ways people misread a result. An image from Gemini, Midjourney, Firefly, Stable Diffusion or a camera will come back not detected, because OpenAI is not looking for their marks. So will a file that has been through enough transformation to break the pixel pattern, and so might a frame lifted from a video. Not detected is the absence of one provider's signal, not the presence of a human.

The file limits are OpenAI's and the relay's together: PNG, JPEG and WebP, up to 50 MiB. HEIC, AVIF and GIF are inspected locally where the browser can decode them, but they are never offered for verification, since OpenAI's API does not accept them.

What a result actually proves

A positive SynthID row proves that OpenAI's pixel watermark is present, which means the image came out of an OpenAI image model, whether or not anyone has edited it since. It does not name the account, the prompt, or the date; SynthID carries no identifying information.

A positive Content Credentials row proves that an OpenAI-signed manifest is present and intact. Combined with the pixel row, that is the strongest statement the file can make about itself. A manifest that is present but issued by someone else is reported as such, and one that is present but broken is reported as Unknown rather than dressed up as a verdict.

A negative on both rows proves that neither of OpenAI's signals was found. That is all. It is consistent with a human photograph, a Gemini render, a heavily reworked OpenAI image, and a screenshot of an image that had its manifest stripped and its pixels resampled enough to lose the pattern. DetectMark does not pick one of those for you, and neither should anyone else.

The corresponding audio story

Audio has followed the same path. Since July 31, 2026, audio generated by OpenAI carries an embedded SynthID mark, and the same Verify tool and Content Provenance API can confirm it. DetectMark does not process audio files, so an audio upload reports Unsupported rather than a guess. The status matrix tracks the row anyway, dated, so the gap is visible instead of hidden.

Where this leaves the other providers

This is the one provider whose image watermark anyone can verify from a browser today. Google's SynthID Detector portal is still waitlist-only for text, and its image, video and audio verification lives inside Google's own surfaces: the Gemini app, with Search and a Chrome rollout for images. Anthropic's detector is in private preview. Adobe's Content Credentials can be read from the file, but that is a manifest check, not a watermark check. The SynthID detector page keeps the per-provider picture current, and what DetectMark cannot remove explains why the pixel mark stays put no matter what a remover promises.