The short answer
C2PA (Coalition for Content Provenance and Authenticity) is an open standard that binds a cryptographically signed record — a manifest — to a media file: what created it, what edits were made, by which tools and people. Content Credentials is the consumer name for that record, shown with a distinctive crisscross pin icon in supported apps.
How it works, without the math
- A camera, editor or generator creates the file and writes a manifest: claims about origin and processing.
- The manifest is signed — tampering with claims or pixels breaks the signature.
- Each later edit can append a new signed step, building a verifiable chain: capture → edit → export.
- Validation tools check the chain end-to-end.
Think of it as a tamper-evident passport for media, not a trust statement: it tells you what was claimed and by whom — how much you believe it depends on the signer.
Where the credential lives
Inside the media file itself: a JUMBF box within JPEG/PNG containers, XMP extensions elsewhere. That placement is its strength (it travels with the file) and its weakness (any metadata-stripping step — most platforms — removes it).
Who is using it
Adobe (Photoshop, Lightroom), Leica and Nikon cameras, OpenAI and other AI providers for generated-media labeling, the BBC and news agencies via the Origin project, and TikTok's AI-content labels. Adoption is early but compounding — especially for AI-generated media, where voluntary labeling is becoming normative.
What C2PA can establish
- That a file's provenance claims are intact since signing — tamper-evidence, not mere declaration.
- A concrete edit chain: which tools touched the file and in what order.
- For AI-generated media: a signed statement of the generation tool and prompt context, where adopters provide it.
What C2PA cannot do
- Survive stripping — screenshot it, re-save it, upload through most social apps and the credential is gone.
- Certify truth — a valid signature authenticates the claims, not reality; a signer can assert false things.
- Retroactively protect old media — only files created or processed by C2PA-aware tools carry credentials.
- Replace verification — provenance complements source-checking, reverse search and context, not substitutes.
Check a file for Content Credentials
The free PictureMatters C2PA checker detects credential markers and shows their readable content alongside a full forensic report. Note that it detects and displays credentials — full cryptographic chain validation needs dedicated C2PA verify tooling.
Technical references
- C2PA Technical Specification (official) — manifest structure, signatures and trust model.
- Content Credentials — the adoption initiative behind the standard.
- IPTC Photo Metadata Standard — digital-source-type declarations for AI media.
Standards evolve; consult the specification for the current normative text. Our coverage of marker detection behavior is published as experiments, not as specification interpretation.