How to read Error Level Analysis

ELA recompresses a JPEG and highlights pixel differences. Bright regions can indicate edits — or social-media re-encoding, filters, and screenshots of screenshots.

Use ELA as a lead, not a verdict.
Compare against a known-original when possible.
Pair with metadata, hash, and contextual investigation.

Try the Image Forensics Laboratory.

What the image actually shows

Error Level Analysis compares a decoded image with a recompressed version. The visualization amplifies differences; it does not label pixels as authentic or fake. High-contrast text, edges and textured surfaces often look brighter than smooth areas. Quality settings change the visualization, so the same source can produce different displays without any change to its history.

A repeatable comparison you can try

Use a photograph you took yourself as a control. Inspect it, then save a second copy at lower JPEG quality and inspect that copy with the same settings. Compare edges, flat backgrounds and fine detail. This small exercise illustrates why bright regions need context. The control is a demonstration of recompression behavior, not a calibration that turns an arbitrary screenshot into forensic proof.

Worked example: a bright amount on a receipt

A bright payment amount can result from text edges, sharpening, scaling or a pasted edit. Compare other text of similar size and contrast in the same image. Ask for the original file rather than a messaging-app preview, and document whether you received a JPEG, PNG or screenshot. Even a visually consistent amount does not prove that a bank credited money. Payment status must be verified independently in the recipient’s account.

Use several independent observations

Preserve the original and calculate a file hash before making experimental copies. Check dimensions and available metadata, compare with a known source, and consider the surrounding conversation. Missing EXIF can simply reflect normal platform processing. A hash proves identity with another copy when they match; it does not establish that the contents are truthful. Provenance markers likewise need validation before making claims about their issuer.

Write a defensible conclusion

A careful report might say: the amount area has a different recompression pattern from nearby text; the cause is unresolved and the original file is needed. Avoid statements such as ELA proves this is forged. Our laboratory provides visual leads and metadata observations, not a validated universal forgery detector. If the decision has legal consequences, retain the evidence and consult an appropriately qualified examiner.