How it works
How OneTime works
OneTime connects a photo or video to signed evidence about where it came from, so anyone can check it later. Here is how that evidence is made, and how it is read.
What provenance evidence is
Provenance is the record of where a file came from and what happened to it. OneTime makes that record cryptographic: it is signed, so any change to the record or to the file it describes can be detected.
The record travels inside the file as Content Credentials, an open standard published by the C2PA (Coalition for Content Provenance and Authenticity). Any compatible tool can read it, not only OneTime.
How media gets its evidence
With the OneTime app, evidence is created at the moment of capture:
The phone processes the photo or video itself and signs its evidence with a hardware-backed key that never leaves the device.
OneTime checks that evidence, records a capture time bounded by its own server clock, and authors the provenance record.
OneTime signs the record with a classical signature and a post-quantum ML-DSA-65 countersignature.
The app embeds the signed record in the file and verifies the final file on the phone.
The phone signs a receipt for the finished file, and OneTime records the capture as complete.
The photo or video is never uploaded during capture. Only digests, signatures and other compact evidence are exchanged.
How integrity is checked
The signed record includes a cryptographic fingerprint of the file’s exact bytes. A verifier recomputes it. If even one byte has changed, the fingerprint no longer matches, and the result says so.
How a result is produced
Read the Content Credentials embedded in the file.
Check every signature against OneTime’s published trust keys, the post-quantum one included.
Recompute the file’s fingerprint and compare it with the signed one.
Compare OneTime’s stored records with the signed evidence. The signed evidence wins: a disagreement is reported, never hidden.
Report whether OneTime’s server-side history for the item stayed intact.