Very soon, the day will come where it will be possible to generate any image with AI and it will be impossible to tell if an image is real of fake. All images will therefore be presumed to be AI generated unless it can be proven that are not. This article gives you a simple way to capture and timestamp all of the real images in your current photograph collection so that you can later prove they are old- and therefore authentic. It is free, only takes a few minutes, and all of your images stay on your computer. Do it now- by next year it will be too late. Maybe even next month.

Overview

Basically we are going make a very big number that includes information about every photo in your collection. That big number is called a top hash. You are then going to publish that top hash in a way that timestamps it. At some later date, you can produce a relatively short list of some other big numbers, and that can mathematically prove that any one of your images is included in the top hash.

Capturing your photos

1. Download my your-merkle program from here.
2. Run your-merkle capture at the top of the directory tree that contains all of the images you want to capture.
3. Publish the top hash that the program outputs when it is done running somewhere that timestamps it. You can use Opentimestamps.org, or put the top hash inside a public tweet, or put it on a page that gets archived at archive.org, or publish in a classified ad in a newspaper, or any other way that someone else in the future will be able to check that the number actually existed.

That’s it – you are now protected. Now you just have to make sure you keep the snapshot file that was created since you will need it later if you want to prove one of your images was in that top hash. Don’t worry- the snapshot file is small, only 64 bytes per captured file. Do note that anyone with the capture file can generate a proof for any of your images, so keep that safe and private.

Proving one of your images is authentic

1. Run your-merkle prove with the top hash value and the path to the file you want to prove.
2. As long as the file was captured in the snapshot file and the file has not changed since then, then the program will print out a proof showing that.

Instructions on how to read/verify the proof are here.

Screenshots

Here is what it looked like when I captured my own massive digital photo library with 139,171 pictures….

My top hash is 45d6ad9659155cdf251c847c198faab87bfa031bff38475e7ad7562a62985f76. (See what I did there?)

Here is what it looks like when I generate a proof of a picture of the plushie microbes my kids got for xmas in 2014…

Now no one can ever say that picture is fake.

FAQ

Q: AI can already make any image. Isn’t it already too late?
A: While current AI images are strikingly good, it is still possible to detect fake images and the tools of the future will be good enough to detect fakes made up until now (1/5/2026). But there is a threshold we will pass where the fakes be too good for any technology to detect.

Q: Privacy?
A: You can check the code of the program an see that it never uploads anything and the top hash does not include any non-hashed information.

Q: So anyone with the top hash can check to see if an image file is in my collection?
A: Very much no. The only way someone can check if an image is inside a capture is if you give them either a proof or you give them your snapshot file. This was surprisingly hard to get the AIs to do!

Q: Magic?
A: Pretty much. Ask an AI about how one way hash functions work and then play HashHunt so you can understand how magic this all is (at least until we find out that P=NP and the party is over).

Q: Can you be more technical?
A: your-merkle scans all of the non-hidden files in the current tree, calculates the SHA256 hash plus a random salt for each file. It then builds a special merkle tree of all the hashes and salts using a commutative combine function. The top hash is the top hash of this tree.

Q: How long does it take?
A: It took less than 30 minutes to capture my massive collection.

Q: Can you make your instructions more beginner friendly?
A: Those days are over. Ask an AI to help you with any part you don’t understand.

Q: So can’t I just ask the AI to do all this hash stuff for me?
A: Surprisingly, no. I asked all the top models (1/1/2026) and they all failed to come up with a correct solution for this. Worse, even when warned to be extra careful about leaking data, they would come up with solutions that superficially looked correct but had deal-breaker security flaws if you really checked.

https://claude.ai/share/70726434-3e4b-445d-a159-8457bec36320
https://grok.com/share/bGVnYWN5_f37a6be9-0e49-48b4-af37-30c7e01ff024?rid=5a2c0ca9-e711-48f1-b056-d7669a4abeac
https://chat.qwen.ai/s/a8254c70-e319-4eea-adf7-f1f78a64073a?fev=0.1.29
https://gemini.google.com/app/fade8f7f94cd578f
https://chatgpt.com/share/69534b47-da4c-8009-a271-c263b4f26157

I predict that there are some serious security flaws lurking in all the vibe code being produced right now – and future evil AIs will be able to find and exploit them.

Q: Does this work on other files besides images?
A: Yes, it does not care what is in the files. I just think that images are the urgent thing that you need capture right now.

Q: So this is blockchain?
A: This has nothing to do with blockchain – although if you want then you can put your top hash on a block chain to timestamp it. This works because there will likely be lots of copies of the block chain around and so it would be hard for someone to change what they all say. This is also why publishing in a newspaper works.

Q: But merkle trees are so bitcoiny.
A: Merkle trees were around long, long before bitcoin, and tbh the way bitcoin uses them doesn’t really even make sense.

Q: Does it handle circular symlinks?
A: No. If you know what a circular symlink is then you don’t need my help with this.

Q: Can I make multiple top hashes?
A: Yes, you can make as many as you want in various different directories and/or at different times.

Q: How do I make a proof if I do not have the original file anymore?
A: You need the original file to prove that it is in the top hash. If you don’t have the file then you really don’t have anything to prove about.

Q: Can you give me a program to validate a proof?
A: Not really because then the person running the program would need to trust me and the whole point of this system is to be trustless. They can ask their neighborhood AI to check the proof for them (if they trust it), or do the check independently themselves if they know how hashes work (not that hard to learn).

###