Free provenance timeline · nothing is uploaded
Every file has a past. Read it as a story.
Other tools dump metadata as a table of cryptic fields. The Time Machine reads the diary your file already keeps — its XMP edit history, the software agents that touched it, the EXIF timestamps — and lays it out in order, as the life story of the file. Drop a photo in and travel it.
Drop a file here, or click to choose one
JPEG, PNG, WebP and MP4 are read locally — the file never leaves your device.
Where a file keeps its diary
Three places, all read by this tool. The XMP history (the xmpMM:History sequence) is the richest: each entry is an event — an action, a timestamp, a software agent — appended by editors such as Photoshop and Lightroom and by some AI generators at export. The XMP packet dates (xmp:CreateDate, xmp:ModifyDate, xmp:MetadataDate) bracket the story even when no history was kept. And the EXIF timestamps in the TIFF block record capture and modification in the camera's own hand.
Read together, they expose the things a flat metadata dump hides: a file "created" by a camera app months after its EXIF capture date; an edit chain that passes through a generator nobody mentioned; a metadata rewrite long after the last pixel edit — the signature of a file that was scrubbed or re-stamped on its way to you.
Questions
What is an XMP edit history?
Many editors and generators record each save in the file's XMP packet as a history sequence: the action taken (created, edited, saved, converted), the time it happened, and the software agent that did it. It is the file's own diary — written by the tools that touched it, stored inside the file, and readable by anyone who knows where to look.
Does the timeline prove a file is authentic?
No. An XMP history is self-written: software records it, and software can rewrite it. The timeline shows what the file declares about its past — valuable for audits, debugging a workflow, and spotting a story that does not add up (a create date after the edit dates, an unknown agent) — but only a signed C2PA manifest gives the history a tamper-evident chain, and even that attests to the record, not to the truth of the scene.
Why does my file show no events?
Most files carry no history because most pipelines erase it: social platforms re-save uploads, messaging apps re-encode, and many exporters write no history in the first place. An empty timeline means the file arrived with no recorded past — which is also what the disclosure checker reports as missing provenance.
Is my file uploaded anywhere?
No. The timeline is built by JavaScript running in your browser; the file never leaves your device. You can confirm it in your browser's network panel — dropping a file makes no upload request.