An NFT holds a pointer, not the picture

Inherited archive entry · retained from the earlier edition. Its factual, legal and policy claims have not all been reverified for 19 September 2026. Research scope.

Two different guarantees, easily conflated

An ERC-721 token, as the standard specifies, stores a tokenId and an owner address on-chain, verified by every node running the network. Its optional metadata extension adds a tokenURI, a string typically pointing to a JSON file that names an image, a description and other attributes. The two guarantees are not the same. The first is enforced by consensus: ownership cannot be altered except by a valid transfer transaction. The second is, absent further design choices, just a stored string, no more binding on its own than a link pasted into a document.

What content addressing changes, and what it does not

Some NFT projects point tokenURI at a content identifier rather than an ordinary web address. The InterPlanetary File System's own documentation on content addressing, as retrieved on 16 September 2026, explains that a CID is derived by hashing the content itself, so that 'any difference in the content will produce a different CID'; retrieving data under a given CID and confirming the hash matches proves the content has not been altered since that identifier was created. That is a genuine, checkable guarantee of integrity. It is not a guarantee of availability. The same documentation is explicit that a CID does not indicate where the content is stored; nothing about the identifier promises that any node is still hosting the data behind it, or will be next year.

Three storage patterns, three different risks

A tokenURI can point to a centralised web server, which can go offline, change its response, or be redirected by whoever controls the domain, with no on-chain trace of the change. It can point to a content-addressed hash on a network like IPFS, which fixes the content itself but says nothing about who is paying to keep it pinned and reachable. Or, in rarer designs described in the ERC-721 documentation, the image or data can be stored directly in the contract's own storage, tying availability to the blockchain's own persistence rather than to any external host. Each pattern trades a different kind of risk for a different kind of cost, and a buyer cannot tell which applies without checking the contract directly.

• Is the tokenURI a plain web address, a content-addressed identifier, or data stored directly in the contract?
• If it is content-addressed, who is currently pinning that content, and what happens if they stop?
• Does calling something 'on-chain' describe the ownership record, the referenced image itself, or only a pointer that could resolve to nothing?

Calling an NFT's contents on-chain is often true only of its ownership record. The two claims, who owns the token and what the token points to, are separable and separately checkable, and worth checking on their own terms before either is taken as guaranteed by the same mechanism.