What C2PA and Content Credentials are
The Coalition for Content Provenance and Authenticity (C2PA) is an industry group whose members include Adobe, Microsoft, Google, OpenAI, camera makers and news organizations. It publishes an open technical standard for content provenance. “Content Credentials” is the friendly name used in apps and on websites, often shown as a small “CR” icon.
Cameras, editing software and AI generators can add a signed record describing how an image was made — captured by a camera, edited in an app, or generated by a model — and verifiers can later check whether the file changed after signing.
What is inside a C2PA manifest
A manifest is a small, structured package with three main parts:
- Claim generator — the app or service that created the manifest, for example an editor or an AI image service.
- Assertions — statements about the content, such as c2pa.actions (created, edited, opened, resized…), a digitalSourceType that can declare AI generation, thumbnails, and references to “ingredient” files used in the edit.
- Signature — a cryptographic signature with a certificate identifying the signer, plus a hash that binds the manifest to the exact image data.
Where Content Credentials are stored in each format
The manifest is wrapped in a JUMBF container, and each format has its own slot for it:
| Format | Where the manifest lives |
|---|---|
| JPEG | APP11 segments |
| PNG | caBX chunk |
| WebP | A dedicated C2PA chunk in the RIFF container |
| HEIC, HEIF, AVIF | A uuid box |
See also: Remove C2PA Content Credentials from Images — Free, No Upload · Remove Metadata from JPG Online — Lossless, No Upload · Remove Metadata from HEIC Photos — Keep HEIC, No Upload
Who adds Content Credentials today
Adoption is growing quickly. Typical sources include:
- AI image services, such as OpenAI’s image generation and Adobe Firefly, which mark their output as AI-generated.
- Editing apps such as Photoshop and Lightroom, either because you enabled Content Credentials or because you used a generative feature.
- Some cameras and phones that sign photos at capture to prove they came from a real device.
- Platforms and news publishers that preserve or display credentials, for example with a “CR” badge.
See also: How to Control Content Credentials in Photoshop and Lightroom (and Clean Your Exports) · Which Platforms Label AI Images? Instagram, Facebook, TikTok, YouTube and More
How to view the Content Credentials of an image
- Drop the file into the tool at the top of this page.
- The “AI & provenance” panel shows whether a C2PA block is present, the claim generator, the recorded actions and the source type.
- For full cryptographic validation of the signature, use an official Content Credentials verification tool as well.
How to remove C2PA Content Credentials
Click “Remove AI metadata” in the tool above. The C2PA block is cut out at the byte level — together with XMP, IPTC and EXIF — and the image data is copied unchanged. HEIC and AVIF files are cleaned in place so the file structure stays valid. The cleaned file is analyzed again so you can confirm that no manifest remains.
What removing a manifest does — and does not do
Removing the embedded manifest deletes the provenance record from that copy of the file. Any edit already breaks the cryptographic binding — verifiers report a manifest that no longer matches the image as invalid — so stripping simply removes a record that would otherwise travel with the file.
Some systems use “durable” Content Credentials: an invisible watermark or fingerprint that lets a verifier look the manifest up in an online repository even after the embedded copy is gone. Metadata cleaning does not affect those mechanisms, because they live in the pixels or in a remote database.
See also: SynthID and Invisible AI Watermarks Explained: What Metadata Cleaning Can and Can’t Do
Should you keep or remove Content Credentials?
Keep them when you want to prove where an image came from — in journalism, for original photography, or when a client asks for provenance. Consider removing them from a shared copy when they reveal software, edit history or identity details you would rather not publish, or when they trigger AI labels on photos that were only lightly edited. Inspect first, then decide per image.
See also: Why are real photos labeled “Made with AI” / “AI info” on Facebook and Instagram?
Questions about C2PA and Content Credentials
What does C2PA stand for?
Coalition for Content Provenance and Authenticity — the industry group that maintains the open standard behind Content Credentials.
Is C2PA the same as an invisible watermark?
No. C2PA is metadata stored next to the image data. Invisible watermarks such as SynthID are embedded in the pixels and are not affected by metadata removal.
Can Content Credentials be faked?
A manifest is signed, so tampering is detectable by verifiers. But a missing manifest proves nothing, and a valid signature only shows who signed it — not that the content is true.
How can I verify a manifest before removing it?
The report lists the claim generator, actions and source type. For full signature validation, use an official Content Credentials verification tool before cleaning the file.
Does removing C2PA reduce image quality?
No. The manifest is a separate block; the compressed image data is copied unchanged.
Do social networks keep Content Credentials?
Some read them during upload to apply labels and strip them from the published copy; a few display them. Behavior varies by platform and changes over time.