Fake screenshots used to be a Photoshop problem. Now they're a one-click problem, which means the volume has gone up roughly by an order of magnitude. Newsrooms get sent fabricated tweets as "evidence" multiple times a week. Brand teams get extorted with fake DM screenshots. Family members get manipulated with doctored chat threads. This guide is the cheat sheet a few of us wish we'd had earlier.
It's aimed at journalists, editors, trust-and-safety teams, and content creators who get sent "leaked" screenshots and have to make a call quickly. The tells split into three buckets: typographic, structural, and metadata.
Typographic tells
Real platforms use specific, version-locked font stacks. Every fake screenshot tool — including ours — uses something close but not exact. The closer you look, the more the differences stack up.
- SF Pro on iOSkerns slightly tighter than Helvetica or any default system fallback. Pinch-zoom in on the bubble text. If the "ti" or "rn" combinations look loose, suspect a fake.
- X (Twitter) uses Chirp. The handle, name, and body text all share it. A fake tweet rendered with system-ui will show subtle differences in the capital R and the lowercase g.
- WhatsApp uses Helvetica Neue on iOS, Roboto on Android. The two have noticeably different lowercase a. Mismatching the OS to the font is a giveaway.
Structural tells
Real apps have invariants you can't fake without thinking about them. Fakers usually don't think about them.
- Bubble corners.In iMessage, the last bubble of a group has a 4-pixel corner on the side facing its tail. The middle bubbles of a group have 18px corners on every side. If a sequence of bubbles all have the same corner radius, it's fake.
- Timestamp pills. iMessage shows a centered timestamp pill every time the conversation pauses for more than 15 minutes. WhatsApp shows the time inside each bubble. Twitter shows time + date below the body for non-feed views and only time-ago for feed views. Mixing these gives away the source tool.
- Status bar math.An iPhone screenshot taken today shows iOS 18 or 19's status bar — the dynamic island, the rounded battery icon, the LTE/5G label position. A "leaked DM" with an iOS 13 status bar is two-plus years stale and almost certainly fake.
- Avatar gradients.Instagram's story ring uses a specific yellow → orange → magenta gradient that most fakes get close to but not exactly right. The gradient stops are 0% / 40% / 100%, not equidistant.
Metadata tells
The PNG itself often gives the game away before you even read the screenshot.
- Look at the corners for a watermark. Reputable generators (including FakeRocket) embed a small attribution mark in the exported PNG. If the screenshot has a tiny URL in a corner, you can stop investigating — it's a prop, by design.
- Check the dimensions.Real iPhone screenshots come at exact device resolutions (e.g., 1290×2796 for iPhone 15 Pro, 1206×2622 for iPhone 14). Generator outputs usually come in marketing-friendly sizes like 1200×630 or arbitrary integers like 400×800. A "real screenshot" that's 1080×1920 is suspicious.
- Inspect the file's color profile.Apple devices embed Display P3 in their screenshots. A standard sRGB PNG from a "real iPhone" is at least worth a follow-up question.
The verification workflow
When something lands in your inbox claiming to be a leaked screenshot, run this in order:
- Save the image and check its dimensions and EXIF metadata. Generator outputs almost never carry phone EXIF.
- Zoom to 200% and look at the typographic tells above. One mismatch is suspicious; two is conclusive.
- Scan the corners for a watermark. If you see one, ask the sender point-blank.
- Run the image through a reverse-image search. Many fakes are edited from a real source screenshot that's already public.
- When possible, ask the supposed sender directly. The screenshot is supposed to be of their conversation; they can corroborate or deny in one message.
Note on adversarial design
The reason this guide exists is that our tools — and others — keep getting better. The structural and typographic tells will get harder to spot. The watermark is currently the most reliable signal because it's author-attached and survives through reposting, screenshotting, and reformatting. That's why every reputable generator keeps one.
If you want to see the patterns in action, build one yourself: the Fake Tweet Generator, Fake iMessage Generator, and Fake Instagram Post Generator each render the platform's visual grammar carefully enough to study, but obviously enough to dismiss when you look at the watermark. The best way to spot a fake is to make one.