C2PA Content Credentials Explained: What They Are and How to Check Them

As AI-generated images become harder to tell apart from photographs, the tech industry has backed a common answer to the question “where did this come from?” It’s called C2PA, and you may already have seen it as a small “CR” Content Credentials icon on an image.

This guide explains what C2PA is, what’s inside it, who adds it, how to check whether a file has it — and what it can’t do.

What C2PA is

C2PA stands for the Coalition for Content Provenance and Authenticity, an industry group founded in 2021 by companies including Adobe, Microsoft, Intel and the BBC, and since joined by Google, OpenAI, Meta, Sony, Samsung and many others. The coalition publishes an open technical standard for recording the provenance of digital media — how a piece of content was made and changed.

Content Credentials is the consumer-facing name for C2PA data, promoted by the Adobe-led Content Authenticity Initiative (CAI).

What’s inside a C2PA manifest

C2PA data is stored as a manifest inside the file. A manifest typically contains:

• Claim generator — the app or device that created the record, for example a camera model, an editing app or an AI image service.
• Actions — what was done to the content: created, opened, edited, cropped, placed, and whether a generative AI tool was used.
• Digital source type — for example, that the content was created by a trained algorithm (AI).
• Ingredients — earlier versions or other files that were combined into this one, each with their own history.
• Hash — a fingerprint of the image data, so any change after signing can be detected.
• Signature — a cryptographic signature from the signer’s certificate, proving which organisation or device made the claim and that the manifest hasn’t been altered.

In JPEG files the manifest lives in APP11 segments using a container format called JUMBF. PNG files store it in a caBX chunk, and WebP in a C2PA chunk.

Who adds C2PA to images

AI image generators

Several major AI services attach Content Credentials to the images they produce, including OpenAI’s image tools and Adobe Firefly. Others record AI use through IPTC fields or invisible watermarks instead — Google, for example, uses SynthID watermarks in addition to metadata.

Cameras and phones

• Google Pixel 10 (2025) signs photos with Content Credentials at capture by default.
• Samsung Galaxy S25 adds credentials to images created or edited with its generative AI features.
• Camera makers including Leica, Nikon, Canon, Sony, Fujifilm and Panasonic have released C2PA-capable cameras, mostly aimed at photojournalists.

Editing software

Adobe Photoshop and Lightroom can attach Content Credentials, and using generative features can record that AI was involved.

Which platforms show it

• LinkedIn displays a Content Credentials icon on images that carry valid credentials; clicking it shows a summary.
• TikTok has used Content Credentials to help label AI-generated content.
• Meta (Instagram, Facebook, Threads) reads C2PA and IPTC signals as part of its “AI info” labelling — see why Instagram shows “AI info” on real photos.
• Some newsrooms and stock libraries use it to verify images.

How to check if an image has C2PA

1. Open the image in the TraceWipe metadata viewer.
2. If C2PA is present, the top of the report shows “C2PA Content Credentials” in the AI footprints box, and the Embedded data blocks group lists the JUMBF/C2PA block and its size.
3. Where readable, the viewer also shows the claim generator text (for example, the name of the AI service).

To cryptographically verify a manifest — check the signature and the signer’s certificate — use the CAI’s official Verify tool at contentcredentials.org/verify.

The limits of C2PA

C2PA is useful, but it is not an AI detector and it isn’t tamper-proof in practice:

• It records what was declared, not what is true. A manifest says what the signing tool reported. It doesn’t analyse the pixels.
• It is easy to remove. Like other metadata, the manifest can be stripped by re-saving, screenshotting or using a metadata remover. Many upload pipelines strip it too. That’s why the industry is working on “durable” credentials that combine manifests with watermarks and fingerprints.
• Missing credentials prove nothing. Most images in circulation have no C2PA data at all, so absence doesn’t mean an image is real or fake.
• Adoption is still early. Industry reports in 2026 estimate that only a small fraction of published news imagery carries C2PA data.
• It can over-label. A tiny AI-assisted edit can produce the same “AI was used” signal as a fully generated image.

Should you keep or remove C2PA?

Keep it when provenance helps you: you’re a photographer proving an image is authentic, a newsroom documenting edits, or a creator who wants to be transparent about AI use.

Remove it when it exposes more than you intend or misrepresents a genuine photo — for example a real photo that was flagged because of a minor AI clean-up. Manifests can also include details about the device, software and editing steps. The TraceWipe metadata remover deletes C2PA blocks along with EXIF, XMP and IPTC, without re-compressing JPEG, PNG or WebP images.

If an image is substantially AI-generated, disclose that when you share it — platform rules and laws such as the EU AI Act increasingly require it.

Frequently asked questions

Is C2PA the same as a watermark?

No. C2PA is metadata attached to the file. A watermark (visible or invisible, like SynthID) is part of the image pixels. Removing metadata does not remove a watermark.

Does removing C2PA damage the image?

No. The manifest is a separate block in the file. Removing it properly leaves the image data untouched.

Can C2PA be forged?

The signature makes undetected changes to a signed manifest very difficult, but a manifest is only as trustworthy as the certificate that signed it, and stripping it entirely is easy.