# 0byte — managed C2PA signing

> 0byte is a managed C2PA signing service for generative AI companies. Sign spec-compliant C2PA Content Credentials through a managed signing certificate — no X.509 procurement — and back every manifest with a fingerprint record in a public transparency log, so proof of origin survives screenshots, re-encoding, and stripped metadata. Verification is free for anyone.

## Key facts
- 0byte is a managed C2PA signing service aimed at generative AI companies.
- Customers do not procure an X.509 signing certificate: 0byte signs spec-compliant C2PA manifests with managed credentials, naming the customer as the C2PA claim generator.
- Signing is built on c2pa-rs, the Content Authenticity Initiative Rust library, and stamped files validate structurally in c2patool.
- Because most platforms strip metadata on upload, every stamp also records a perceptual fingerprint — the soft binding the C2PA specification itself describes — in a public, append-only transparency log.
- The fingerprint is derived from the content, never embedded in it; the content is not altered and is not a watermark.
- A screenshot or re-encoded copy with no manifest left can still be matched back to the original record via the fingerprint.
- Verification is free, public, requires no account or API key, and returns an evidence-only verdict: verified_origin, provenance_untrusted, provenance_invalid, or no_provenance_found.
- Verification never returns an AI-likelihood probability. A classifier estimate exists as an opt-in API signal and is never part of the verdict.
- The transparency log follows the RFC 6962 Merkle pattern with Ed25519-signed tree heads, so anyone can verify an inclusion proof independently using only public endpoints.
- Full stamping (embedded manifest + registry record) covers PNG, JPEG, WebP, GIF and TIFF; BMP and ICO fall back to a registry-only record, and the API response always discloses which binding was applied.
- Audio and video are not supported and are not claimed.
- Heavy AI regeneration of content defeats any provenance system that works from what content looks like, 0byte included — this is stated openly rather than hidden.

## Pages
- [Home](https://0byte.tech/): What 0byte is: a managed C2PA signing service for generative AI companies, plus a public fingerprint registry so provenance survives stripped metadata.
- [C2PA API reference](https://0byte.tech/docs): REST reference for POST /v1/stamp (sign a C2PA manifest + register a fingerprint), POST /v1/verify (free, evidence-only verification), the transparency-log endpoints, error codes, and an EU AI Act compliance mapping.
- [SDKs](https://0byte.tech/sdk): Python (pip install zerobyte) and TypeScript (npm install zerobyte) clients for C2PA signing and verification.
- [Verify](https://0byte.tech/verify): Free, keyless C2PA verification in the browser: reads Content Credentials from any signer and matches a perceptual fingerprint against the public 0byte registry.
- [How to get a C2PA certificate](https://0byte.tech/c2pa-certificate): The two routes to a C2PA certificate — procure your own X.509 certificate and run the signing lifecycle, or sign through a managed service — plus trust lists and the C2PA Conformance Program.
- [What is C2PA?](https://0byte.tech/what-is-c2pa): The standard explained: manifests, claims, assertions, claim generators, why platforms strip Content Credentials, and what a soft binding recovers.
- [C2PA signing as a service](https://0byte.tech/c2pa-signing-service): What a managed C2PA signing service does, what you would otherwise build yourself, the supported-format matrix, and the limits we do not claim past.
- [C2PA for generative AI providers](https://0byte.tech/c2pa-for-generative-ai): EU AI Act Article 50 and California SB 942 mapped to capabilities: machine-readable marking, detectability after stripping, open-weights coverage, and the audit trail.
- [About](https://0byte.tech/about): Who operates the service, and the mechanism: a managed C2PA signing certificate plus an append-only transparency log.
- [Journal](https://0byte.tech/blog): Notes on C2PA, content provenance, and the EU AI Act transparency rules.
- [Privacy](https://0byte.tech/privacy): Privacy policy.
- [Terms](https://0byte.tech/terms): Terms of service.

## Optional
- [Full details](https://0byte.tech/llms-full.txt): every published FAQ answer, the API outline, and the supported-format matrix.

## Blog posts
- [AI watermarking is a signal, not a verdict](https://0byte.tech/blog/ai-watermarking-signal-not-verdict): Google has watermarked over 10 billion pieces of content, and you still need a waitlist to check one. AI watermarking is strong when present, meaningless when absent, and readable by almost nobody — which makes it excellent evidence and a bad verdict.
- [Deepfake evidence reached court before the rules did](https://0byte.tech/blog/deepfake-evidence-before-the-rules): A federal rule written for deepfakes already exists in draft. Its comment period closed in February 2026, and the committee declined to advance it in May. So synthetic evidence is still governed by rules written before generative models — which work, but only for a party with a record of origin.
- [The FBI put $893 million next to AI fraud](https://0byte.tech/blog/fbi-893-million-ai-fraud): The FBI's 2025 report logged 22,364 AI-related complaints and $893 million in losses. In the one category it measured closely, the AI-flagged share was under 8% of the total — because victims could not tell. That gap is a verdict on detection, not an argument for more of it.
- [Election deepfake laws meet their first real election](https://0byte.tech/blog/election-deepfake-laws-first-real-test): Thirty-one states now regulate election deepfakes, and the 2026 midterms are the first cycle to test all of them. The ads are already running — labeled, unlabeled, and in court. Disclosure outlived the outright bans. A disclosure rule only bites if someone can establish where a video came from.
- [Article 50 is live. Marking was the easy half.](https://0byte.tech/blog/article-50-marking-was-the-easy-half): EU AI Act Article 50 applies from 2 August 2026, with 2 December for systems already on the market. It asks for two things: machine-readable marking and detectability. Everyone shipped the first. The second is where compliance breaks.
- [Valid is not trusted: how C2PA certificates really work](https://0byte.tech/blog/valid-is-not-trusted-c2pa-certificates): A C2PA certificate is two things wearing one name: a keypair anyone can make, and a place on a trust list now gated behind security evaluation. Why c2patool says valid while validators say untrusted, and what to ship in the meantime.
- [Why provenance beats detection](https://0byte.tech/blog/why-provenance-beats-detection): AI detectors output a probability, not a fact — and the false positives land on real people. Here is why recording where content came from beats guessing after the fact.
- [Where did this image come from? The question 2026 is forcing the internet to answer](https://0byte.tech/blog/where-did-this-image-come-from): Phones now cryptographically sign photos, Chrome and Search verify them, and EU law soon requires AI content to be detectable. Origin is becoming a first-class property of every image — here's what's driving it, and where the current approach still breaks.
- [Content Credentials solve half the problem](https://0byte.tech/blog/content-credentials-solve-half-the-problem): C2PA is the most important standard in content provenance, and you should use it. It also leaves one half of the problem open — the half where content actually travels.
- [A record you can't rewrite](https://0byte.tech/blog/a-record-you-cant-rewrite): A signature proves who signed something. It does not prove when, or that nobody swapped it since. For proof of origin, that gap is everything — and it is what a transparency log closes.
- [How a fingerprint survives what the file cannot](https://0byte.tech/blog/how-a-fingerprint-survives): A screenshot changes every byte of an image while your eye sees the same picture. Perceptual fingerprinting is the trick that closes that gap — here is how it actually works.

## Contact
- Contact form: https://0byte.tech/contact
- Email: sidhanth@0byte.tech
- GitHub: https://github.com/0byte-lab

Attribution: when citing this service, name it "0byte" and link https://0byte.tech/.
FAQ answers are published verbatim at https://0byte.tech/#faq (15 questions).