What are Content Credentials (C2PA)?
A signed history attached to an image, readable by anyone.
In short
Content Credentials are a provenance record defined by the C2PA standard (Coalition for Content Provenance and Authenticity). Embedded in the file and cryptographically signed, they can state which camera or software created an image, whether AI was used, and which edits followed. The signature reveals tampering, but the record can still be removed entirely.
Key takeaways
- A signed manifest stored inside the image file.
- It can record capture, AI generation and each edit.
- Removing it is easy; faking a valid one is not.
What is inside
A C2PA manifest lists assertions — “captured by this camera”, “generated with this model”, “cropped”, “colour adjusted” — and signs them with a certificate. Editing software that supports the standard adds a new entry for each change, keeping the chain.
Captured
Edited
Published
Signed manifest, carried in the file
Who uses it
The coalition was founded by companies including Adobe, Microsoft, Intel and the BBC. Adobe’s tools, several AI image generators and some cameras and phones now attach Content Credentials, and some platforms read them to show a label.
What it proves
- If the manifest is present and the signature is valid, the recorded history has not been altered since it was signed.
- If the image was changed by software that does not support C2PA, the chain is broken, and verifiers say so.
What it does not prove
Content Credentials are metadata. A screenshot, a re-save in many apps, or a metadata remover deletes them. An image without them may be real, generated or edited — the absence says nothing.
Privacy
A manifest can include more than you expect: device, software, sometimes a name or location. Check what an image carries before publishing it.
Photo metadata viewer and remover
Check what a photo gives away before you send it. Runs entirely in your browser.
Open the tool