What are C2PA Content Credentials
A digitally signed origin statement embedded in an image file. It records who made the picture, with which tool, and what was done to it, and anyone can verify it.
In one sentence
C2PA (Coalition for Content Provenance and Authenticity) is an open standard from a coalition that includes Adobe, Google, Microsoft, OpenAI, Sony, Nikon and the BBC. It defines how to write provenance information into a file and sign it. Adobe's user-facing name for it is Content Credentials.
What it looks like
A C2PA manifest is embedded in the file without touching the pixels. In a JPEG it sits in an APP11 segment, in a PNG in a caBX chunk, in WebP in a C2PA chunk. It contains three kinds of things:
- Assertions: concrete statements.
c2pa.actionsrecords "created in Photoshop", "generated with Firefly", "cropped".c2pa.hash.datarecords a hash of the image content.c2pa.ingredientrecords source material. - The claim: bundles the hashes of every assertion and names the claim generator, file format and title.
- The signature: signs the claim with an X.509 certificate in COSE format. The certificate subject is the signer, for example Adobe Inc., Google LLC, or a camera manufacturer.
What it can prove
If the signature is valid, the certificate chain is trusted and the content hash matches the image, then you know the picture and its manifest have not been altered since signing, and that the statements in the manifest were made by the signer.
It cannot prove the statements are true. A camera can claim "digital capture", a generator can claim "AI-generated". These are the signer's assertions. Trust comes from who signed, not from the act of signing.
Who writes C2PA today
- AI generators: OpenAI's DALL·E and GPT Image, Adobe Firefly, Microsoft Designer, some Google products.
- Cameras and phones: Leica M11-P, Sony α1 II and α9 III, Nikon Z6III, Google Pixel 10 (signs every photo by default), Samsung Galaxy S25 for AI edits.
- Editors: Photoshop, Lightroom, Premiere and other Adobe apps can opt in.
- Platforms: Instagram, LinkedIn and TikTok read and display the label; some keep the manifest.
Common misconceptions
No C2PA means fake? No. Most pictures have no C2PA because most tools do not write it yet. Absence only means "cannot be verified".
C2PA means real? Also no. It depends on who signed, whether the signature is valid, and what the manifest says. A perfectly valid manifest can state "generated by AI".
Does C2PA survive deletion? No. The manifest is part of the file; strip the metadata and it is gone. It guards against tampering, not removal.
How AuditImage shows it
After you upload a picture, the "C2PA Content Credentials" section lists each manifest's generator, signer certificate, actions and ingredients, with every assertion's raw content expandable. The "Verification" block gives a result per check: signature, content hash binding, assertion hashes and certificate chain, and says whether the signer is on the C2PA trust list; the timestamp token is only reported as present. For a second opinion use the Content Authenticity Initiative's Verify or the c2patool command line tool.