Blog Forensics Updated 6 min read

How to Detect if an Image is a Screenshot

Screenshots and photographs have distinct technical fingerprints. Here's how to identify screen captures using resolution matching, EXIF analysis, format signals, and automated detection.

How to Detect if an Image is a Screenshot

Photos and Screenshots Leave Different Traces

A photograph captures light through a camera sensor — it proves something physically existed. A screenshot captures whatever was on a screen, which could be a real message, an edited webpage, or a completely fabricated conversation. The distinction matters because it determines how much you can trust the image. Courts, journalists, and insurance adjusters all need to know which they're looking at.

The good news: screenshots and photographs have very different technical fingerprints. Resolution, metadata, file format, compression patterns, and noise characteristics all differ in predictable ways. Combining these signals gives reliable classification.

Try it free: Screenshot Scanner — detect whether an image is a screenshot, right in your browser.

The 8 Detection Signals

The Screenshot Scanner checks all 8 simultaneously. No single one is conclusive — it's the combination that works.

1. Screen Resolution Matching

The strongest indicator. Screenshots have dimensions that exactly match device screens — 1170×2532 (iPhone 14/15), 1080×2400 (Samsung Galaxy), 1920×1080 (HD monitors), 3840×2160 (4K). Camera photos produce sensor-determined dimensions like 4000×3000 or 6000×4000. An exact screen-size match in either orientation is a very strong signal.

2. Missing Camera EXIF

Camera photos carry rich EXIF metadata — make, model, lens, ISO, aperture, GPS. Screenshots have none of that. Upload one to the EXIF Checker and you'll find either empty metadata or just a timestamp. Complete absence of camera fields is one of the most reliable indicators.

3. PNG File Format

macOS, Windows, iOS, and most Android devices save screenshots as PNG by default. Cameras save JPEG or HEIC. A PNG with screen-matching dimensions and no camera metadata is a strong triple signal. This weakens when messaging apps convert screenshots to JPEG during sharing.

4. Software Tags

Some screenshots carry explicit tool names in metadata: "Snipping Tool," "macOS Screenshot," "ShareX," "Greenshot." These are definitive — if the software field names a screenshot utility, the question is settled.

5. Compression Characteristics

UI content — menus, text, flat backgrounds — compresses very efficiently as PNG, producing low bytes-per-pixel ratios (often under 0.5). Natural photos have much higher ratios because every pixel varies. The Quality Analyzer reports these metrics.

Need to verify if an image is a screenshot? Upload it and find out instantly.

Try Screenshot Scanner →

6. Color Profile

Screenshots use sRGB at 8-bit depth. Camera photos may use Display P3 (iPhones), Adobe RGB (professional cameras), or ProPhoto RGB. A wider-than-sRGB color space strongly suggests camera origin.

7. Noise Patterns

Camera sensors produce characteristic grain, especially at higher ISO. Screenshots have zero sensor noise — they're mathematically perfect pixel copies. Even a screenshot of a photo doesn't show real sensor noise because display rendering flattens it.

8. Visual UI Elements

Status bars, browser chrome, window title bars, cursors, notification banners — cameras never produce these. The scanner checks for characteristic pixel patterns in the top and bottom edges where UI elements typically sit.

Edge Cases

Cropped screenshots lose the resolution-matching signal (the strongest one), but missing EXIF, format, and compression patterns still apply. Screenshots of photos create hybrids — they look like photographs but have screenshot characteristics. Messaging apps that convert screenshots to JPEG weaken the format signal. Retina/HiDPI screens capture at 2× or 3× density, so a "2560×1440" MacBook produces a 5120×2880 image. And photographing a screen with a camera produces a real camera photo with full EXIF — technically a photograph, not a screenshot, even though it shows UI content.

How to Check

Upload to the Screenshot Scanner — processing happens entirely in your browser. The tool analyzes all 8 signals, rates each individually, and gives a combined verdict: screenshot, photograph, or uncertain. For uncertain results, use the EXIF Checker to manually inspect metadata, the Authenticity Checker for broader analysis, and the AI Detector to rule out AI generation.

Common Questions

Can someone fake a screenshot to look like a real photo? Possible but hard. Fake EXIF can be injected, but creating plausible camera metadata (correct make/model, realistic exposure settings, lens info) is complex. The image will also lack sensor noise, lens distortion, and depth-of-field that real photos have.

Why does it matter? A photograph proves something existed in the real world. A screenshot proves what appeared on a screen — which could be genuine, edited, or fabricated. In legal and journalistic contexts, the origin type determines how the image can be used as evidence.

Do social platforms preserve detection signals? Partially. Most strip metadata and recompress, removing metadata-based signals. Screen-resolution dimensions are often preserved. PNG may become JPEG. Visual UI elements survive any processing.

What about cropped screenshots? Cropping removes the resolution signal, but missing EXIF, format, and compression patterns still apply. Visual UI elements survive if they weren't in the cropped region.

Screenshots Tell on Themselves

No single signal is conclusive, but 8 independent indicators combined produce reliable classification. The Screenshot Scanner runs all of them automatically — drop a file and get a verdict in seconds.

Try Screenshot Scanner
Share:
S

Scanly.co — 80 free image analysis tools

Photo forensics, metadata, privacy, OCR, and utilities. All client-side.