Content Credentials (C2PA): a signed receipt, not an AI label

A Content Credential is a C2PA manifest: a signed record, carried in a file, of what a camera, an editing app or an AI image generator stated about how that file was made and changed. It proves who signed those statements and that the file has not been altered since. It does not prove the statements are true. An embedded credential travels in the file's metadata and lasts only as long as that metadata does, unless a copy is kept elsewhere.

That makes it a receipt, not a label. A maker who reads it that way can keep it intact, check it properly and draw no conclusion from its absence.

What is C2PA, and what does a Content Credential record?

C2PA is the Coalition for Content Provenance and Authenticity, and its technical specification defines how provenance is written into a file. "Content Credential" is the plain-language name the specification prefers for a C2PA manifest. The project behind Content Credentials has grown to hundreds of companies, including Microsoft, Adobe, Google, OpenAI, Sony and Meta.

A manifest has three parts. The assertions are individual statements about the file, such as how it was created, what edits were made, which device captured it, and the cryptographic hashes that tie the record to the content. The claim gathers those assertions, and the claim signature is a digital signature over the claim, made with the signer's credential.

The C2PA's own explainer says every manifest must carry two assertions. One lists the actions performed, such as created or edited. The other is a hard binding, a hash that makes any change to the file invalidate the manifest.

A record can also point to its ingredients. A parent is a source image the new one was made from. A component is a part placed inside it. An input is information used to make it, such as the prompt given to a generative AI system. Version 2.4 of the specification also adds an assertion for machine-readable AI disclosure.

Who adds a Content Credential to an image?

Whatever tool writes the file can add one. The specification calls that tool a claim generator, and it can be hardware or software. Its own worked example is a C2PA-enabled camera or phone that builds a manifest with details of the camera, a thumbnail and hashes, then embeds it in the JPEG.

AI image generators add them too. When OpenAI launched ChatGPT Images 2.5, it wrote: "We continue to use C2PA metadata and invisible watermarking to help identify images made with our tools."

In a January 2024 roundup, Adobe listed other adopters:

• Photoshop and Lightroom, where creators can attach their name, the date, edits and tools used
• Firefly text-to-image and Generative Fill
• the Leica M11-P camera
• Bing Image Creator, which Microsoft uses to label all its AI-generated images
• Qualcomm's Snapdragon 8 Gen3 platform
• camera commitments from Sony and Nikon

Adoption is optional by design: the specification is written for opt-in adoption. A credential tells you something when it is present. When it is missing, it tells you nothing.

How is a Content Credential checked?

A validator checks the signature and the signer's certificate first, then each assertion. It then shows the result so a person can judge it. Trust rests on who signed. Credentials use X.509 certificates, the same technology behind web TLS and PDF signatures, and the C2PA keeps its own trust list of certificate authorities. On screen, the sign is a small pin that opens to show how the content was made and its editing history.

A valid result means something narrow, and the specification says so. It makes no judgement about whether provenance data is good or bad. It checks only whether the assertions are tied to the asset, correctly formed and free from tampering. The explainer adds that it does not judge whether the provenance is true.

A credential stating that a camera captured an image proves that a trusted signer said so about these exact bytes. That is a lot, and it is all.

What removes C2PA metadata?

Anything that rebuilds the file without writing a new manifest. The hard binding is a hash of the content, so a change made by a tool that does not update the record leaves the credential invalid. The explainer says credentials are routinely removed or corrupted by platforms that do not support them. That is common on social media, which shows copies at a different resolution, size or quality. The viewer may see no difference, but the file's bytes have changed.

Google DeepMind's SynthID announcement says the same about metadata in general: it can be removed by hand or lost when files are edited.

Not every loss is damage. The explainer says provenance is not always complete, and a later tool can attach a new active credential that is trusted on its own signer. Makers also get some control over what goes in. The specification encourages tools to let creators decide whether certain provenance data is included. It also allows assertions to be redacted when a file is reused as an ingredient, though never the record of actions.

How is a credential different from an invisible watermark?

A credential is a record carried with the pixels. An invisible watermark is a signal hidden in the pixels. The specification defines an invisible watermark as information built into the content in a way people cannot perceive, used for example to identify the asset or to point to a manifest.

SynthID, Google DeepMind's watermark for Imagen images, is built to stay detectable after filters, colour and brightness changes and lossy JPEG compression. Google says it is not foolproof against extreme manipulation.

The trade is detail for durability. A watermark carries an identifier or a likelihood, not the history. SynthID, for example, gives one of three confidence levels that an image came from Imagen.

C2PA links the two. A watermark or a content fingerprint can act as a soft binding: a key that finds a copy of the credential stored in a manifest repository after the embedded one is stripped. The specification calls this a Durable Content Credential.

What should a maker do to keep credentials intact?

Keep the master. The file your tool exported carries the full record. Keep it unedited, because it is what you show when someone asks how the work was made.

Edit in tools that write credentials. The specification is built so each change is added to the existing provenance. Edit in a tool that ignores credentials, and the provenance may not be updated for that change, leaving the credential invalid or missing.

Expect platforms to drop it. If the record matters, share the original as well as the posted copy. Watermarks and repositories exist to cover that gap.

Check what you sign. Some tools, such as Photoshop and Lightroom, let creators attach their name to the credential, and the specification encourages tools to let creators control what provenance data is included. Before you export, see what yours writes.

Read absence correctly. A file without a credential is not shown to be fake, and a file with one is not shown to be true. The credential shows who vouched for what.

That covers the working knowledge. The small next step is to check what your current tools write before your next export. For the full picture, read the C2PA explainer, then the specification's sections on validation and soft bindings.

Frequently asked questions

What is C2PA?

C2PA is the Coalition for Content Provenance and Authenticity, which publishes the standard for signed provenance records in media files. The record itself is called a Content Credential.

Do AI-generated images have C2PA metadata?

Some do. OpenAI says it uses C2PA metadata on images made with its tools, and Adobe's 2024 roundup listed credentials in its own Firefly and in Microsoft's Bing Image Creator. The standard is opt-in, and metadata can be stripped after export, so many AI images do not carry one.

What removes C2PA metadata?

Edits by tools that do not update the record, re-encoding and resizing by social platforms, and deliberate metadata removal.

What is the difference between C2PA and a watermark?

A C2PA credential is a signed record of a file's history carried in its metadata. An invisible watermark hides an identifier in the pixels; Google says its SynthID watermark stays detectable even when metadata is lost.

Does a missing Content Credential mean an image is fake?

No. Adoption is optional and credentials are often stripped in distribution, so a missing credential proves nothing either way.