What is C2PA (Content Credentials) and what does it do to your images?

The short version

C2PA is the Coalition for Content Provenance and Authenticity, a group of technology, media and camera companies. It publishes a standard, often shown to the public as Content Credentials, for attaching a record to an image, video or audio file that says where it came from and how it was changed.

The record is called a manifest. It is digitally signed, so if someone edits the manifest afterwards, the signature no longer matches and software can tell.

What a manifest can say

• Which tool or device created the file, for example a camera or an AI image generator.
• Which editing tools were used afterwards.
• Whether the content was generated or changed with AI, if the tool chose to record that.
• Who signed the record.

Who adds it

Some AI image tools and some editing apps add Content Credentials to their output, and a few cameras can sign photos as they are taken. Support is growing but uneven: many tools add nothing, and which ones do changes over time. If you need to know about a specific tool, check its own documentation.

Where it lives in the file

In a JPG the manifest is stored inside the file, in a metadata segment. Other formats store it in their own way. A separate way of linking a file to a record held online also exists, which means the label can sometimes be restored even when the embedded data is gone.

What it can and cannot prove

• It can show that a file carries a signed claim from a particular tool or person, and that the claim has not been altered since.
• It cannot prove that the claim is true. It records what the signer says happened.
• A missing manifest proves nothing. Screenshots, re-saving, resizing and many upload pipelines drop it, and most images never had one.
• The picture itself can still be judged by a platform or a person, whatever the file data says.

Checking a file yourself

The photo metadata checker on Toolstia looks for C2PA data and other markers in JPG, PNG and WebP files, and tells you whether it found any. It does not verify signatures. For that you need dedicated verification software.

A note on honesty

You are free to strip metadata from images you own. But many platforms and some laws ask you to disclose AI-generated or AI-edited content, and removing a label from a file does not remove that duty. Use cleaning for privacy, not to mislead people about how something was made.