Double-JPEG detection
Was this photo opened and re-saved?
Every time a JPEG is saved it is compressed again. Opening a photo in an editor and saving it compresses it twice, and that second pass leaves a tell-tale pattern in the file's frequency data: the histogram of a single compression coefficient picks up regular gaps and uneven peaks. This reads that histogram and tells you whether the comb looks like one save or two. Read it as a lead, not proof.
Runs entirely in your browser. Your image is never uploaded or stored.
The orange bars are the comb: peaks that sit at even spacings because JPEG rounds each coefficient to a multiple of its quantization step. On a photo saved once the teeth fade smoothly outward from the centre. When a file has been saved twice at different qualities, some teeth are pushed up and others emptied out, so the comb looks periodically uneven. That unevenness is what the "double-save irregularity" figure measures.
Why a second save shows up
A JPEG is compressed by running an 8x8 discrete cosine transform on each block and rounding the result to multiples of a quantization step. Decode that file and the frequency values you recover still cluster at those multiples, which is why the histogram of one coefficient looks like a comb. Save the picture a second time at a different quality and the values get rounded again, onto a different grid. The two grids rarely line up, so the final histogram has some bins that collect hits from two old bins and some that collect none. The result is a comb with periodically taller and missing teeth. Lukas and Fridrich described exactly these features in the DCT histogram as the signature of double compression.
How to read the result
| What you see | What it can mean |
|---|---|
| A clean comb, teeth fading smoothly outward | Consistent with a single save, straight from the camera or one export |
| A comb with periodic gaps or uneven teeth | Consistent with a re-save: the file was opened and compressed a second time |
| No comb at all (a smooth hump) | Not a real JPEG history: a PNG, screenshot, rescaled image or very high quality, so there is nothing to read |
What fools it
The signal lives in the 8x8 compression grid, so anything that moves that grid erases it. Resizing, cropping to a non-multiple-of-eight offset, or a screenshot all destroy the comb, and this tool reports "no comb" rather than a false result in those cases. It also needs the two save qualities to differ: re-saving at the exact same quality leaves almost no trace. And a positive result tells you the whole frame was compressed twice, not which region was edited. To find a single spliced patch instead, use the JPEG Ghost tool, and pair either with the photo edit check and the metadata viewer before drawing a conclusion.
Sources
- Lukas, J. & Fridrich, J. (2003). Estimation of Primary Quantization Matrix in Double Compressed JPEG Images. Digital Forensic Research Workshop (DFRWS) 2003.
- Farid, H. (2009). Exposing Digital Forgeries from JPEG Ghosts. IEEE Transactions on Information Forensics and Security 4(1):154-160. DOI: 10.1109/TIFS.2008.2012215