WebP Image

Format	WebP Image
Short name	WebP
Category	media
Platforms	Windows, macOS, Linux, iOS, Android, QNX
Crush support	Supported `(ImageParser)`
Status	Reviewed
Last reviewed	2026-10-04

Forensic relevance

Modern image format used by Chrome, Android apps, and messaging platforms for compressed photos, stickers, and screenshots. Stored in a RIFF container — 'RIFF' at offset 0, 'WEBP' at offset 8. Supports lossy (VP8) and lossless (VP8L) compression, animation (ANMF frames), alpha channel, ICC color profiles, and EXIF/XMP metadata in dedicated chunks. Messaging platforms commonly use WebP for stickers. The lossless variant preserves pixel data exactly — useful for detecting re-encoding. Unknown chunks in the RIFF structure may contain application-specific or hidden data. A C2PA (Content Credentials) manifest, when present, is carried in a dedicated 'C2PA' RIFF chunk and can record generating/editing software and an IPTC Digital Source Type — a direct AI-generation/-editing signal.

Signatures

Offset	Hex	ASCII (non-printable as .)	Description
offset 0 (0x0)	52 49 46 46	RIFF	RIFF container header
offset 8 (0x8)	57 45 42 50	WEBP	WebP signature within RIFF container ('WEBP' at offset 8)

Known extensions

.webp

References

WebP container specification (Google) https://developers.google.com/speed/webp/docs/riff_container
WebP Image Format (RFC 9649) https://datatracker.ietf.org/doc/rfc9649/
WebP metadata handling (exiv2) https://dev.exiv2.org/projects/exiv2/wiki/The_Metadata_in_WEBP_files
C2PA Technical Specification (Content Credentials) https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html

Cite this entry

Crush Format Reference, “WebP Image”. https://kalink0.github.io/crush-forensics/formats/webp/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction