# 0byte — managed C2PA signing > 0byte is a managed C2PA signing service for generative AI companies. Sign spec-compliant C2PA Content Credentials through a managed signing certificate — no X.509 procurement — and back every manifest with a fingerprint record in a public transparency log, so proof of origin survives screenshots, re-encoding, and stripped metadata. Verification is free for anyone. ## Key facts - 0byte is a managed C2PA signing service aimed at generative AI companies. - Customers do not procure an X.509 signing certificate: 0byte signs spec-compliant C2PA manifests with managed credentials, naming the customer as the C2PA claim generator. - Signing is built on c2pa-rs, the Content Authenticity Initiative Rust library, and stamped files validate structurally in c2patool. - Because most platforms strip metadata on upload, every stamp also records a perceptual fingerprint — the soft binding the C2PA specification itself describes — in a public, append-only transparency log. - The fingerprint is derived from the content, never embedded in it; the content is not altered and is not a watermark. - A screenshot or re-encoded copy with no manifest left can still be matched back to the original record via the fingerprint. - Verification is free, public, requires no account or API key, and returns an evidence-only verdict: verified_origin, provenance_untrusted, provenance_invalid, or no_provenance_found. - Verification never returns an AI-likelihood probability. A classifier estimate exists as an opt-in API signal and is never part of the verdict. - The transparency log follows the RFC 6962 Merkle pattern with Ed25519-signed tree heads, so anyone can verify an inclusion proof independently using only public endpoints. - Full stamping (embedded manifest + registry record) covers PNG, JPEG, WebP, GIF and TIFF; BMP and ICO fall back to a registry-only record, and the API response always discloses which binding was applied. - Audio and video are not supported and are not claimed. - Heavy AI regeneration of content defeats any provenance system that works from what content looks like, 0byte included — this is stated openly rather than hidden. ## Pages - [Home](https://0byte.tech/): What 0byte is: a managed C2PA signing service for generative AI companies, plus a public fingerprint registry so provenance survives stripped metadata. - [C2PA API reference](https://0byte.tech/docs): REST reference for POST /v1/stamp (sign a C2PA manifest + register a fingerprint), POST /v1/verify (free, evidence-only verification), the transparency-log endpoints, error codes, and an EU AI Act compliance mapping. - [SDKs](https://0byte.tech/sdk): Python (pip install zerobyte) and TypeScript (npm install zerobyte) clients for C2PA signing and verification. - [Verify](https://0byte.tech/verify): Free, keyless C2PA verification in the browser: reads Content Credentials from any signer and matches a perceptual fingerprint against the public 0byte registry. - [How to get a C2PA certificate](https://0byte.tech/c2pa-certificate): The two routes to a C2PA certificate — procure your own X.509 certificate and run the signing lifecycle, or sign through a managed service — plus trust lists and the C2PA Conformance Program. - [What is C2PA?](https://0byte.tech/what-is-c2pa): The standard explained: manifests, claims, assertions, claim generators, why platforms strip Content Credentials, and what a soft binding recovers. - [C2PA signing as a service](https://0byte.tech/c2pa-signing-service): What a managed C2PA signing service does, what you would otherwise build yourself, the supported-format matrix, and the limits we do not claim past. - [C2PA for generative AI providers](https://0byte.tech/c2pa-for-generative-ai): EU AI Act Article 50 and California SB 942 mapped to capabilities: machine-readable marking, detectability after stripping, open-weights coverage, and the audit trail. - [About](https://0byte.tech/about): Who operates the service, and the mechanism: a managed C2PA signing certificate plus an append-only transparency log. - [Journal](https://0byte.tech/blog): Notes on C2PA, content provenance, and the EU AI Act transparency rules. - [Privacy](https://0byte.tech/privacy): Privacy policy. - [Terms](https://0byte.tech/terms): Terms of service. ## Optional - [Full details](https://0byte.tech/llms-full.txt): every published FAQ answer, the API outline, and the supported-format matrix. ## Blog posts - [Article 50 is live. Marking was the easy half.](https://0byte.tech/blog/article-50-marking-was-the-easy-half): EU AI Act Article 50 applies from 2 August 2026, with 2 December for systems already on the market. It asks for two things: machine-readable marking and detectability. Everyone shipped the first. The second is where compliance breaks. - [Valid is not trusted: how C2PA certificates really work](https://0byte.tech/blog/valid-is-not-trusted-c2pa-certificates): A C2PA certificate is two things wearing one name: a keypair anyone can make, and a place on a trust list now gated behind security evaluation. Why c2patool says valid while validators say untrusted, and what to ship in the meantime. - [Why provenance beats detection](https://0byte.tech/blog/why-provenance-beats-detection): AI detectors output a probability, not a fact — and the false positives land on real people. Here is why recording where content came from beats guessing after the fact. - [Where did this image come from? The question 2026 is forcing the internet to answer](https://0byte.tech/blog/where-did-this-image-come-from): Phones now cryptographically sign photos, Chrome and Search verify them, and EU law soon requires AI content to be detectable. Origin is becoming a first-class property of every image — here's what's driving it, and where the current approach still breaks. - [Content Credentials solve half the problem](https://0byte.tech/blog/content-credentials-solve-half-the-problem): C2PA is the most important standard in content provenance, and you should use it. It also leaves one half of the problem open — the half where content actually travels. - [A record you can't rewrite](https://0byte.tech/blog/a-record-you-cant-rewrite): A signature proves who signed something. It does not prove when, or that nobody swapped it since. For proof of origin, that gap is everything — and it is what a transparency log closes. - [How a fingerprint survives what the file cannot](https://0byte.tech/blog/how-a-fingerprint-survives): A screenshot changes every byte of an image while your eye sees the same picture. Perceptual fingerprinting is the trick that closes that gap — here is how it actually works. ## Contact - Contact form: https://0byte.tech/contact - Email: sidhanth@0byte.tech - GitHub: https://github.com/0byte-lab Attribution: when citing this service, name it "0byte" and link https://0byte.tech/. FAQ answers are published verbatim at https://0byte.tech/#faq (15 questions).