What Is C2PA? Content Credentials Explained

What is C2PA?

What is C2PA? It is both an organization and the standard it publishes. The Coalition for Content Provenance and Authenticity writes the technical specification that lets software attach a verifiable record of origin and edits to digital content.

That record is called Content Credentials. A camera, an editing app or an AI image generator can write it into the file and sign it. Anyone can later read it back and check that it has not been altered.

Think of it as a nutrition label for media: it lists the ingredients and the processing steps, with a seal that breaks if someone tampers with the label.

The history can be layered. When an edited image is exported, its manifest can point back to the manifest of the original file, which points back to its own sources. Following that chain shows you each step between the first capture or generation and the file in front of you.

Who is behind C2PA and Content Credentials?

C2PA is backed by technology and media companies and run as a Joint Development Foundation project. According to the coalition's founding press release, it was announced on February 22, 2021, by Adobe, Arm, BBC, Intel, Microsoft and Truepic.

It brought together two earlier efforts: the Adobe-led Content Authenticity Initiative and Project Origin, led by Microsoft and the BBC. Both continue to promote adoption, while C2PA maintains the technical standard. Membership has grown since to include many more camera makers, software companies, platforms and news organizations.

In 2023, C2PA introduced an official Content Credentials icon, a small “CR” mark. When an app or website displays it on an image, you can usually hover over or click it to see the history.

You are most likely to meet Content Credentials in three places: files exported from editing software that supports the standard, images made with AI generators that attach them, and photos from cameras built to sign their captures. Some news organizations and platforms also read credentials to show provenance or AI labels to their audience.

What does a C2PA manifest contain?

A C2PA manifest contains signed statements about a file and a cryptographic link to the file itself. The statements are chosen by whoever signs them, so two manifests can contain very different amounts of detail.

Generative AI tools can record that a file was created with generative AI using the IPTC digital source type vocabulary, whose value for this case is “trainedAlgorithmicMedia”. That single field is what a C2PA checker looks for first.

How do you verify Content Credentials?

You verify Content Credentials by opening the original file in a C2PA checker, which reads the manifest, validates the signature and shows the history. The steps are the same whichever tool you use.

1. 01Get the original file, not a screenshot or a copy downloaded from a social network.
2. 02Look for the “CR” icon if the file is displayed on a website that supports it.
3. 03Upload the file to a C2PA checker, such as the Verify tool linked from contentcredentials.org or the AnyFact Content Credentials checker.
4. 04Read the validation status: is the signature valid, and does the certificate come from a trusted signer?
5. 05Read the history: the tool that created the file, the actions applied and any ingredients.
6. 06Compare that history with the claims made about the file, such as its date, place or author.

Here is what that comparison looks like in practice. A picture is shared as “a photo taken at the protest this morning”. Its credentials, signed by an image editor, list one ingredient: a file created with a generative AI tool, then cropped and color-adjusted. The signature is valid. You now know the picture was generated, even though nothing in the pixels looked wrong.

The reverse case matters too. A photo whose credentials show a camera capture and a simple crop supports the claim that it is a real photograph, but the date, place and caption still need checking. A real photo can be old, from somewhere else, or of a staged scene.

What does C2PA prove, and what doesn’t it prove?

C2PA proves that a history was attached by a given signer and has not been changed since. It does not prove that the content is true, that the scene is real or that the signer was honest.

The C2PA explainer is explicit that Content Credentials “do not provide value judgments” about whether provenance data is true. A genuine photo of a staged scene can carry perfect credentials. A signer can also make mistakes in what it records.

• Valid and trusted: the history is intact and the signer is on an accepted trust list.
• Valid but unknown signer: the history is intact, but you cannot rely on who signed it.
• Invalid: the file or the manifest changed after signing. Treat the history with caution.

Why do missing Content Credentials prove nothing?

Missing Content Credentials prove nothing because most files never had them, and many that did lost them along the way. Adding provenance is optional under the standard.

• Many cameras, phones and generators do not write C2PA manifests.
• Social platforms and messaging apps commonly strip metadata when you upload.
• Screenshots, screen recordings and re-encoding create a new file with no history.
• Some editing tools do not carry an existing manifest forward when they export.

Soft bindings, such as invisible watermarks or content fingerprints, are designed to help recover a stripped manifest from an online repository, but they only work where both the creator and the checking tool support them. So when there are no credentials, move on to the other checks in how to tell if an image is AI generated.

C2PA metadata vs EXIF, XMP and watermarks

C2PA metadata differs from ordinary metadata because it is signed and bound to the content. EXIF and XMP fields can be edited by anyone with a free tool, so they are useful clues but weak evidence.

That difference works in both directions. A forger can add a convincing camera model to an AI image’s EXIF data, or delete the field that names the generator, and nothing will flag the change. Forging a C2PA manifest that validates against a trusted certificate is a far harder task, which is why signed credentials carry more weight than any plain metadata field.

Video works the same way: a clip can carry credentials, and platforms may use them to show an AI label. See how to spot a deepfake video for what to do when they are missing.

What are the limits of C2PA, and should you add Content Credentials to your work?

C2PA is a strong tool with clear limits: it only helps when it is present, intact and signed by someone you can trust. It is a complement to detection and judgment, not a replacement.

• Adoption is uneven: many devices, apps and platforms do not write, keep or display credentials.
• Stripping is easy: a screenshot or a re-encode removes the manifest from the file itself.
• Trust depends on the signer: a valid signature from an unknown signer proves little about who made the content.
• Truth is out of scope: credentials record how a file was made and edited, not whether what it shows happened.
• Privacy needs care: if you sign your own work, check which details, such as location or name, your app includes.

If you publish original photos, video or reporting, adding Content Credentials is still worth it. Use a camera or editing app that supports the standard, keep your original files, and publish where the credentials are preserved or displayed. If your work is ever questioned, a signed history created at the time is far stronger evidence than anything you can assemble afterwards.

How does AnyFact use C2PA?

AnyFact reads provenance before anything else. Every detector first checks the file for C2PA content credentials and EXIF/XMP metadata; if they name a known AI generator, the verdict is probably AI and the reason is stated.

When there is no such evidence, the analysis continues with an open-source detector, a second opinion from Claude in the grey zone, and a plain-language explanation. That applies to the AI image detector, to video, and to the AI document detector, which also reads document metadata and checks embedded images.

Newsrooms that want to build provenance checks into their workflow can start with our page for journalists and fact-checkers. Why provenance beats statistical detection when it is present is covered in are AI detectors accurate.

Frequently asked questions