Provenance Chain Lab
A provenance chain is a sequence of links — source → transform → sign → publish → verify — and it is only as trustworthy as its weakest one. Build the chain below, then inject a break: an unrecorded edit, an untrusted key, a stripped manifest, tampering after signing. Watch the verifier walk the chain and fail at the first broken link, and read what that break actually means. Provenance is a dial, not a switch — you choose where to build a full chain — but where you claim one, a single gap makes the whole claim worthless.
The photo is captured, and its origin (who, when, how) is recorded.
It is cropped / colour-corrected; each edit is appended to the manifest.
The manifest + content hash are cryptographically signed by a trusted signer.
The asset is published with its signed manifest attached and intact.
A third party re-checks the signature and hash, end to end.
What this lab is
- An interactive lab: build the provenance chain for a piece of content or a model artifact — source, transform, sign, publish, verify — then inject a tampering or gap event and watch exactly where verification breaks.
- The core lesson: provenance is only as strong as its weakest link. One unrecorded edit, one untrusted signing key, one stripped manifest, or any tampering after signing invalidates the whole claim — not just that step.
- It teaches what a broken or missing link actually means to a verifier, so you can tell a genuinely trustworthy chain from one that merely looks signed.
- Provenance is a dial, not a switch: you need not build a full signed chain for every artifact, but when you do assert provenance, a single break makes the assertion worthless — so apply the full chain where the stakes justify defending it.
- Fully client-side and free — nothing you build or break leaves your browser, no account.
Why this matters
Provenance fails in a way that is easy to miss: the asset still carries a signature, the manifest still looks official, and everything appears fine — until someone actually verifies it and discovers that an edit was never recorded, or the signer is not trusted, or the bytes changed after signing. A chain with one broken link is not partially trustworthy. To a verifier it is simply untrustworthy, because a gap means they cannot know what else was changed. Teams that treat “we signed it” as the finish line ship exactly this kind of hollow assurance.
The flip side keeps it honest: building a full, verifiable chain for everything is wasteful, so the real decision is where to invest. On high-stakes artifacts, build the whole chain and defend every link. Elsewhere, claim less and spend less. This lab trains the instinct to see a chain the way a verifier does — link by link, weakest-first — so you neither trust a broken chain nor over-build one you will never need to defend.
Frequently asked questions
What is the Provenance Chain Lab?
A free, in-browser lab where you inspect the provenance chain for a piece of content or a model artifact — the ordered links from its source, through each transform or edit, to signing, publishing and finally verification. You can inject realistic faults — an unrecorded edit, an untrusted signing key, a manifest stripped during publishing, or tampering after signing — and the lab traces the chain and shows you the first link where verification breaks and why.
Why does one broken link break the whole chain?
Provenance is a claim that a specific artifact came from a specific origin and was changed only in recorded ways. Verification re-checks that claim end to end: it confirms the signature is from a trusted signer and that the signed content matches what you are holding, with no unrecorded gaps. If any link is missing or altered — the source is unknown, an edit was not recorded, the key is not trusted, the manifest was stripped, or the bytes changed after signing — the verifier can no longer trust the rest, because it cannot tell what else was changed. A chain that is signed but has a gap is not partly trustworthy; it is untrustworthy.
What is the difference between a missing link and a tampered link?
A missing link is an absence — no recorded source, an edit nobody logged, a signature that was never applied, or a manifest dropped in re-encoding. It means you cannot prove part of the history. A tampered link is an active contradiction — the content was altered after it was signed, so its hash no longer matches the manifest. Both cause verification to fail, but tampering is detectable as a mismatch (strong evidence something is wrong), whereas a gap is an unknown (you simply cannot vouch for it). The lab distinguishes the two in its explanation.
Does every artifact need a full provenance chain?
No. Provenance is a dial, not a switch. Building and maintaining a full signed, verifiable chain costs engineering, storage and process, and it is justified for high-trust and high-stakes artifacts — news media, evidence, legal and financial content, critical model weights. For low-stakes, ephemeral artifacts, lighter measures like simple disclosure are proportionate. The lab's point is narrower and always true: whenever you do assert a provenance chain, it must be complete, because a single broken link makes the whole assertion worthless.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.Educational — general guidance, not security or legal advice.