JPEG Ghost Scanner

Detects spliced regions in JPEG images by sweeping compression quality levels. Tampered areas saved at a different quality appear as "ghosts" in the difference map.

500+ images analyzed

Drag & drop a file here, or

JPG JPEG JPEG only • Quality sweep 60–99 • Processed in browser

Compression Ghosts

Reveals regions saved at a different JPEG quality than the rest of the image, indicating splicing or compositing.

Quality Estimation

Sweeps quality levels 60–99 and identifies the original save quality by finding the minimum error point.

Diff Heatmap

Amplified difference visualization highlights spliced regions that respond differently to recompression than the background.

100% Private

All analysis runs locally in your browser using Canvas API. Your image is never uploaded to any server.

How JPEG ghost detection works

Every JPEG image carries invisible traces of its compression level. When you re-save a JPEG at the same quality it was originally encoded, the error introduced is minimal — the image is already "adapted" to that quality. But if a region was pasted from a different JPEG saved at a different quality, that spliced region responds differently to recompression. The JPEG Ghost Scanner exploits this by re-encoding the image at every quality level from 60 to 99 and measuring pixel-by-pixel differences. At the estimated original quality, spliced regions "glow" because they show higher error than the background. The technique complements the ELA Scanner, which detects compression inconsistencies from a single re-save rather than a full quality sweep.

When to use this tool

JPEG ghost analysis is most effective when you suspect that parts of an image were copied from another JPEG and pasted into the current one — a technique known as splicing or compositing. Journalists use it to verify whether press photos have been manipulated. Insurance investigators check submitted damage photos for pasted elements. Social media researchers use it to detect fabricated screenshots and doctored evidence. The quality sweep chart also serves as a standalone tool for estimating the JPEG save quality of any image, which is useful for archival and quality assurance. For metadata-based tampering detection, combine this with the Authenticity Checker.

Reading the quality sweep chart

The quality sweep chart plots mean squared error at each re-encode quality from 60 to 99. A characteristic "dip" in the curve marks the estimated original save quality — at that level, re-encoding barely changes the image because it's already optimized for those quantization tables. A sharp, clear dip indicates a single-compression JPEG. A flat or noisy curve may indicate the image has been through multiple compression rounds or was converted from a non-JPEG format. Click any bar to view the ghost heatmap at that quality level. The Quality Analyzer provides additional quality metrics including sharpness, noise, and exposure analysis.

Combining forensic techniques

JPEG ghost analysis is strongest when combined with other forensic tools. The ELA Scanner reveals compression inconsistencies through error level amplification — a complementary approach that sometimes catches edits JPEG ghosts miss, and vice versa. The Thumbnail Scanner checks if the embedded EXIF thumbnail still matches the main image. The Stego Scanner detects hidden data encoded in pixel values. Together, these tools cover pixel-level, compression-level, metadata-level, and steganographic analysis — the four pillars of image forensics. Our photo authenticity guide walks through the complete verification workflow.

The JPEG ghost technique was introduced in academic forensic research as a way to detect double JPEG compression at different quality levels — a telltale sign of image splicing. When a forger takes a region from one JPEG (compressed at quality A), pastes it into another JPEG (compressed at quality B), and saves the result, the pasted region retains artifacts from quality A that conflict with the surrounding quality-B background. By re-encoding at quality B and computing the difference, the pasted region stands out because it hasn't adapted to quality B the way the background has. The quality sweep approach scans all levels to catch splices regardless of the specific quality mismatch. While not foolproof — sophisticated editors can re-save at matching quality or use non-JPEG source material — JPEG ghost analysis remains one of the most accessible and effective forensic techniques for detecting image manipulation. Combined with the AI Detector for synthetic content and the File Hash Scanner for verifying file integrity, it provides a thorough forensic toolkit.

Frequently Asked Questions

What is a JPEG ghost?

A JPEG ghost is a visual artifact that appears when parts of a JPEG image were originally saved at a different compression quality than the rest. When you re-encode the entire image at a specific quality level and compute the difference from the original, regions that match that quality level show minimal error, while regions from a different quality level show higher error — they "glow" in the difference map, like ghosts.

How does the quality sweep estimate the original save quality?

The scanner re-encodes the image at every quality level from 60 to 99 and measures the mean error at each level. When a JPEG is re-saved at the same quality it was originally encoded, the error is minimal because the image is already adapted to those quantization tables. The quality level that produces the lowest mean error is the estimated original save quality, visible as a dip in the sweep chart.

What does it mean when regions glow in the heatmap?

Bright regions in the heatmap indicate areas where the pixel difference between the original and re-encoded image is higher than the surrounding areas. At the estimated original quality level, this means those regions were likely pasted from a source saved at a different JPEG quality — a strong indicator of splicing or compositing. The brighter the glow, the larger the quality mismatch.

Can this detect all types of image manipulation?

No. JPEG ghost analysis specifically detects regions saved at a different JPEG quality level. It will not detect edits where the source material was saved at the same quality, where the source was a PNG or raw file, or where the forger carefully re-saved to normalize compression across the image. Color adjustments, exposure changes, and clone-stamp edits within the same image also don't create quality-level ghosts. Combine with ELA, thumbnail analysis, and metadata inspection for comprehensive forensics.

Is my image uploaded to a server?

No. All processing happens entirely in your browser. The image is loaded onto an HTML Canvas element, re-encoded at each quality level using the Canvas API's native JPEG encoder, and the difference maps are computed in JavaScript. Nothing is transmitted, stored, or logged on any server. The quality sweep typically takes a few seconds depending on image size.

Complementary tools: ELA Scanner for error level analysis • Thumbnail Scanner for EXIF thumbnail mismatch • Authenticity Checker for metadata verification