Private in-browser analysis

Video Forensics

Walk an MP4, MOV, WebM or MKV file's container structure, read the timestamps and encoder tags it carries, inspect individual frames, and sweep its keyframes for the compression discontinuity that marks a spliced or substituted scene - without uploading anything.

Your video stays on this device

Drop a video file here

MP4, MOV, M4V, WebM or MKV - the container is read directly, so structure and metadata work even for codecs this browser cannot play

Choose video

Load a video to begin

Analysis tools

Overview

What kind of file this is, how long it runs, what codec it carries, and whether this browser can actually decode its frames.

Container Structure

The file's full box or element hierarchy with each entry's byte offset and size - the layout itself often says more about a file's history than its metadata does.

Coded Stream

Reads the H.264 or H.265 sequence parameter set out of the compressed video itself and holds it up against what the container claims. The encoder wrote one; a muxer wrote the other.

Metadata

Creation and modification times, the encoder or muxer that wrote the file, track languages, GPS location, and every consistency check that can be run across them.

Frame Timeline

The spacing between keyframes, the gaps in the presentation timeline where frames appear to have been removed, and - on request - a SHA-256 and a perceptual hash of every decoded keyframe.

Frame Inspector

Move to any point in the video and run a single frame through the same pixel analyses the image tool uses.

Analysis

Timestamp 0.00s

ELA quality 75

Amplification 12

Keyframe Sweep

Samples keyframes across the whole video and looks for a point where the compression signature changes sharply while the picture barely does - the signature of a substituted scene rather than an ordinary cut.

Frames to sample

Sensitivity 3.5

AI Artifact Check

Looks for the regular frequency-domain pattern that generated and upscaled imagery tends to leave behind. A heuristic signal, never a verdict.

Sensitivity 4

Audio Track

Describes the audio recorded alongside the video and pulls it out of the container as a standalone file, ready for the mains-hum and noise-floor analyses in Audio Forensics. Nothing is decoded or re-encoded.

Content Credentials

Reads any C2PA manifest embedded in the container, showing what the file claims about how it was captured and edited.

Strings

Readable text found in the file's header and trailer regions, where encoder names and leftover editing metadata tend to sit.

Understanding Video Forensics

The Container Is Not the Codec

An MP4 file is a tree of nested boxes - ftyp declaring what the file claims to be, moov holding every track's timing and sample tables, and mdat holding the compressed picture data itself. WebM and MKV use a different scheme entirely, tagged elements with variable-length lengths, but the idea is the same. That structure is plain documented binary, completely separate from the codec inside, which is why a file's layout, timestamps and encoder tags can be read here even when the browser has no decoder for the video it contains.

Why Box Order Matters

A camera writes mdat first and appends moov at the end, because it cannot know a recording's sample tables until the recording stops. Software that prepares video for the web moves moov to the front so playback can start before the file finishes downloading. So a file whose moov sits at the front did not come straight off a camera - it has been through an editing or export step, regardless of what its metadata claims. Padding boxes, duplicated tracks and edit lists tell similar stories about a file's history.

Why Only Keyframes Get Compared

Most frames in a video are not pictures at all - they are descriptions of how the previous frame changed. Only keyframes are coded independently, as complete standalone images. Comparing a keyframe against a predicted frame means comparing two fundamentally different things, and any analysis of the difference measures the codec's prediction rather than the file's history. That is why this tool reads the container's own keyframe index and samples only those frames, so that every frame in a sweep is being compared with like.

What a Splice Actually Looks Like

When footage from another source is dropped into a video, the inserted section has usually been compressed a different number of times, at different settings, than the material around it. That leaves a measurable step in how much detail survives re-compression. The difficulty is that an ordinary scene change produces a similar step for entirely innocent reasons, so a step on its own means nothing. What is worth attention is a sharp change in compression signature at a point where the picture itself barely changes - and that is the combination this tool reports.

The Encoder's Own Rhythm

An encoder left to itself emits a keyframe on a fixed schedule - every two seconds, every sixty frames - and holds that schedule for the whole file. Editing does not preserve it. Cutting a clip and re-encoding the affected region, or joining two clips together, forces a keyframe where the encoder would never have placed one. So a group of pictures that breaks the file's own pattern marks a point where the timeline was interfered with, and it does so without reference to anything visible in the picture. A second, independent signal sits beside it: the presentation timeline. Frames removed from a recording leave a stretched interval behind, because the frames either side kept their original timings and the hole between them has to go somewhere.

Two Sources of Truth

A video file states its resolution twice. The container says it in tkhd and stsd, and the compressed stream says it again in its own sequence parameter set - a block of bit-packed fields the encoder wrote once, at the moment the picture was actually compressed. Rewrapping a file into a new container rewrites the first copy and never touches the second. When the two disagree, the container was rewritten after encoding, which is a fact about the file's history that no amount of metadata editing can conceal. The same goes for the frame rate, where a whole-ratio disagreement - 25 against 30, 30 against 60 - is the classic signature of a rewrap.

Everything runs locally. The video you load is parsed and analyzed entirely in your browser using JavaScript, and frames are decoded by the browser's own video engine. Nothing is uploaded to a server at any point. Frame-level analysis depends on that engine supporting the codec in your file - HEVC in particular is often unavailable outside Apple platforms - so when a codec cannot be decoded, the structural and metadata tabs still work and the frame tabs say plainly why they cannot.

These are signals, not verdicts. Variable-bitrate encoding, changes in scene complexity, and any re-encode applied to a whole file all shift the same measurements a splice does. This tool detects encoding discontinuity, which is evidence worth investigating - not proof of forgery. Treat every finding as a pointer to a timestamp that deserves a closer look.

Key Takeaways

Container structure, timestamps and encoder tags are readable even for codecs your browser cannot play.
A moov box at the front of an MP4 means the file has been processed, not recorded straight to disk.
Only keyframes are standalone images, so only keyframes can be meaningfully compared against each other.
A compression break where the picture does not change is far more interesting than one at a scene cut.
A group of pictures that breaks the file's own keyframe rhythm marks where the timeline was edited.
The coded stream carries its own resolution and frame rate; disagreeing with the container proves a rewrap.
Mains hum on the audio track is one of the strongest timestamp checks there is - extract the track and run it through Audio Forensics.
Nothing leaves your device - the file is never uploaded.

Video Forensics - Free Online MP4 & WebM Metadata, Splice & Deepfake Analyzer