The coalition and the standard
The Coalition for Content Provenance and Authenticity (C2PA) was founded in 2021 by Adobe, Arm, BBC, Intel, Microsoft and Truepic. Google, OpenAI, Meta, Amazon, Sony, Nikon and TikTok joined later. The group publishes a technical specification for attaching a signed history to media files. Content Credentials is the consumer-facing name for that history, promoted by the Content Authenticity Initiative.
What a manifest records
- Claim generator. The software that wrote the manifest, such as Adobe Photoshop 25.0 or an OpenAI service.
- Actions. Created, opened, edited, resized, color-adjusted, and for generative tools a digital source type saying a trained algorithm was used.
- Ingredients. Source files and their own manifests, so edits chain together.
- Hashes. A hash of the image data that binds the manifest to these exact pixels. Change the pixels and the binding breaks.
- Signature. A cryptographic signature and certificate chain identifying who signed the manifest. Validation requires trust lists.
Where it lives in a file
Scroll sideways to see all columns →
| Format | Location | Notes |
|---|---|---|
| JPEG | APP11 segments carrying JUMBF boxes | Large manifests span several segments |
| PNG | A caBX chunk | Placed before the image data |
| WebP | A dedicated RIFF chunk | Newer and rare; this site flags it and offers re-encoding |
| HEIC, AVIF, MP4 | ISO BMFF boxes | Not handled by this site |
| Remote | A URL in XMP pointing to a hosted manifest | Some tools reference rather than embed |
Who writes Content Credentials
Adobe apps (Photoshop, Lightroom, Firefly, Express), OpenAI (DALL-E and ChatGPT image generation), Microsoft (Designer, Bing Image Creator, Copilot), Google (Pixel cameras and Imagen through SynthID plus metadata), Leica and Nikon cameras, Truepic, Canva, TikTok’s AI effects and a growing list of others. Which platforms display or act on them is covered in the Instagram, TikTok and LinkedIn guides.
What happens when you remove it
The manifest is a separate block, so it can be removed without touching the pixels. Nothing in the standard prevents that; C2PA is designed to prove what a credential says, not to make removal impossible. Once removed, verify tools report “no Content Credentials”. Re-encoding goes further and produces pixels that no longer match any old manifest’s hash, so a credential cannot simply be reattached.
- Remove Content CredentialsLossless strip with re-check.
- AI image metadata explainedWhat each generator embeds.
Questions people ask
Are Content Credentials the same as a watermark?
No. A credential is metadata that can be removed. A watermark such as SynthID is embedded in the pixels. Some tools use both.
Does this site verify C2PA signatures?
No. It parses the manifest and shows what it claims. Signature validation needs certificate trust lists and is best done with the official Verify tool.
Do all AI images have Content Credentials?
No. Open-source tools such as Stable Diffusion front-ends usually write plain text metadata instead, and many services write nothing at all.