What are C2PA Content Credentials and how do you read them?
C2PA is a signed record that shows where a file came from; it is better known as Content Credentials. It works like a nutrition label: it says who made the content, with which tool and when, and how it was edited afterward. Because the record is signed, you can tell if the file has been changed.
Who developed it, and who uses it?
C2PA (Coalition for Content Provenance and Authenticity) is an open standard developed jointly by Adobe, Microsoft, Google, OpenAI and many media and technology companies.
OpenAI, Adobe Firefly and Google's image tools add Content Credentials to the files they create. Some Leica, Nikon and Sony cameras and some smartphones also add them to the photos they take.
Since August 2, 2026, Article 50 of the European Union's AI Act has required AI providers to mark the content they generate in a machine-readable way. That is why more and more files carry Content Credentials.
What do Content Credentials say?
Content Credentials can include:
- The software or device that created the content (e.g., an AI tool or a camera model).
- Where the content came from: whether it was captured with a camera, generated with AI, or a combination of the two.
- The edits made: cropping, color correction, editing with AI and so on.
- The organization that signed the record and when it was signed.
- The file's fingerprint (hash) at the moment the record was created.
How is the signature verified?
The record is signed with a digital certificate. Verification answers two questions. First: has the file changed since it was signed? If it has, the fingerprint no longer matches, and this is plainly visible. Second: who signed it? Anyone can create their own certificate and sign a file. That is why verification checks whether the signer is on the trust list published by C2PA.
If the signature is intact and the signer is on the list, the statement is trustworthy. If the signer is not on the list or its certificate has expired, the statement cannot be verified. But that does not mean the file was changed.
Limitations
Because Content Credentials are stored inside the file, they can be removed. Many social networks strip this record from uploaded files, and taking a screenshot removes it too. That is why the absence of Content Credentials proves nothing.
To reduce this problem, companies use Content Credentials together with invisible watermarks. A watermark can still carry a clue about where the content came from, even if the record is removed.
Frequently asked questions
Can Content Credentials be faked?
Anyone can sign a file with their own certificate. That is why it matters whether the signer is on the trust list. Our checking tool shows a statement from a signer that is not on the list only as an indicator, not as evidence.
How can I see Content Credentials myself?
You can upload the file to our checking tool or use C2PA's official Content Credentials Verify site. Both tools read the record and verify the signature.
What does “the signer could not be verified” mean?
It means the signing certificate is not on the trust list or has expired. In that case the statement cannot be verified. But it does not mean the file was changed after it was signed; that is a separate situation and is listed separately in the report.