What does C2PA stand for?

The Coalition for Content Provenance and Authenticity — a joint effort by Adobe, Microsoft, the BBC, Intel, and others, now including OpenAI, Google, and Meta. It maintains the open technical standard behind Content Credentials.

How do I know if an image has Content Credentials?

Some apps show a small 'cr' pin icon on credentialed content. You can also check the file directly — the origin checker on this site reads the embedded manifest locally and shows you what it says.

Can Content Credentials be faked?

The manifest is cryptographically signed by the issuing tool, so a forged credential from a trusted signer should fail verification. But anyone can strip credentials entirely, and self-signed manifests exist — which is why verification against the signing authority matters for high-stakes checks.

Does C2PA prove an image is NOT AI-generated?

No. A credential can confirm AI involvement when present, but its absence proves nothing — most cameras and editors don't write credentials yet, and metadata can always be removed.

Is C2PA the same as an invisible watermark?

No. C2PA lives in the file's metadata — readable and removable. Invisible watermarks (like Google's SynthID) are embedded in the pixels themselves and survive metadata stripping, but can't be read without the provider's detector. The two are complementary layers.

All guides

What is C2PA? Content Credentials explained

When a photo lands in your feed, it usually arrives with no backstory. C2PA — the Coalition for Content Provenance and Authenticity — is the industry's attempt to ship that backstory inside the file itself, as a cryptographically signed record called Content Credentials.

What a credential says

Who made it — the signing tool or device: a camera, Photoshop, an AI generator.
What happened to it — a history of actions: created, opened, edited, cropped, converted.
Whether AI was involved — a digitalSourceType flag can mark content as trained-model output or a composite including AI media.
A signature — cryptographic proof the manifest hasn't been altered since the signer wrote it.

Where you're already seeing it

OpenAI embeds credentials in DALL·E images, Google in its Imagen output, Meta labels AI content across its apps, and Adobe tools write them on export. Leica and Nikon ship cameras that sign at the shutter. It is quietly becoming the default plumbing for content origin.

What it can't prove

Two honest limits. First, credentials can be stripped — they're metadata, and any metadata tool (including ours) removes them, which is why "no credential" never proves "no AI". Second, presence alone isn't verification: checking the signature against the issuing authority is a separate step that needs the official toolchain. Our origin checker reads what a credential claims, locally, and says plainly that it hasn't cryptographically verified it.

The other layer

C2PA works alongside invisible watermarks like Google's SynthID: the credential is a label anyone can read, the watermark is a signal hidden in the pixels that survives stripping but needs the provider's detector. Together they cover each other's weaknesses — neither alone is sufficient.

Common questions

What does C2PA stand for?: The Coalition for Content Provenance and Authenticity — a joint effort by Adobe, Microsoft, the BBC, Intel, and others, now including OpenAI, Google, and Meta. It maintains the open technical standard behind Content Credentials.
How do I know if an image has Content Credentials?: Some apps show a small 'cr' pin icon on credentialed content. You can also check the file directly — the origin checker on this site reads the embedded manifest locally and shows you what it says.
Can Content Credentials be faked?: The manifest is cryptographically signed by the issuing tool, so a forged credential from a trusted signer should fail verification. But anyone can strip credentials entirely, and self-signed manifests exist — which is why verification against the signing authority matters for high-stakes checks.
Does C2PA prove an image is NOT AI-generated?: No. A credential can confirm AI involvement when present, but its absence proves nothing — most cameras and editors don't write credentials yet, and metadata can always be removed.
Is C2PA the same as an invisible watermark?: No. C2PA lives in the file's metadata — readable and removable. Invisible watermarks (like Google's SynthID) are embedded in the pixels themselves and survive metadata stripping, but can't be read without the provider's detector. The two are complementary layers.