As generated images became indistinguishable from photographs, the industry's response was not better detection — it was provenance. Rather than trying to identify what an image is by looking at it, C2PA attaches a signed record of where it came from. This page covers how that works and, more usefully, exactly what it does and does not prove.
What it is
A cryptographically signed manifest embedded in the file, recording what created the image and what was done to it since. Any modification to the pixels invalidates the signature. The critical limitation: it proves things about images that have a manifest, and says nothing about images that do not.
What a manifest contains
The signature covers both the claim and a hash of the image data. Change one pixel and the hash no longer matches, so validation fails — which is the whole security property.
| Assertion | Records |
|---|---|
c2pa.actions | What was done — created, cropped, colour-adjusted, generated by AI |
c2pa.hash.data | Cryptographic hash binding the manifest to these pixels |
c2pa.ingredients | Source assets used, each with its own manifest |
c2pa.training-mining | Whether the creator permits use in AI training |
c2pa.soft-binding | Watermark or fingerprint for recovery after stripping |
The ingredients assertion is the genuinely clever part. Editing a photograph in software that supports C2PA produces a new manifest that references the original's manifest. A chain builds up, so a published image can carry a verifiable history back to the camera that took it.
Where it is stored
| Format | Location |
|---|---|
| JPEG | An APP11 marker segment |
| PNG | A caBX chunk |
| WebP, AVIF, HEIF | A dedicated box in the container |
| MP4, MOV | A metadata box |
| An embedded stream object | |
| Any format | Sidecar file, or a cloud manifest store |
Every case uses the format's existing extension mechanism — the same PNG chunk system that carries text metadata, the same JPEG marker system that carries EXIF. Nothing about the image data changes, which is why a decoder that has never heard of C2PA displays the image normally.
What it cannot do
This is the section that matters, because C2PA is routinely described as solving a problem it does not solve.
🚨 Absence of a manifest proves nothing
C2PA is an attestation system, not a detection system. It tells you what a signed claim says about an image that carries one.
An image with no manifest could be a genuine photograph from a camera without C2PA support, a legitimately edited image processed by software that does not preserve manifests, an image that passed through a platform that stripped it, or an AI-generated image someone deliberately cleaned. These are indistinguishable.
Anyone treating "no credentials" as evidence of anything has misunderstood the system.
A screenshot defeats it entirely
This is not a flaw in the implementation. It is inherent to attaching data alongside pixels: the visual content survives being copied and the metadata does not. Photographing a screen, re-encoding, or simply passing the file through a tool that does not preserve the chunk all have the same effect.
What a valid signature actually asserts
| Proves | Does not prove |
|---|---|
| The pixels match the signed hash | The image depicts something real |
| A specific certificate signed the claim | The claim's contents are true |
| Recorded actions were logged | No other actions occurred elsewhere |
| The manifest has not been altered | The image was not staged or misleading |
The second row deserves emphasis. C2PA signs a claim. If the software generating the claim is dishonest or compromised, it signs a dishonest claim with a valid signature. The trust ultimately rests on the certificate authority and the integrity of the signing tool — the same trust model as code signing, with the same limits.
Soft bindings
Because manifests are so easily lost, the standard supports soft bindings — identifiers carried in the pixels themselves rather than in metadata.
| Approach | How it works | Survives |
|---|---|---|
| Invisible watermark | Imperceptible pattern encoded into the pixels | Re-encoding, resizing, screenshots |
| Perceptual hash | Fingerprint of visual content, matched in a registry | Moderate edits |
These recover provenance after metadata is gone: fingerprint the image, look it up in a registry, retrieve the manifest. Several major generators now watermark their output this way.
⚠️ Watermarks are robust against accident, not against attack
Invisible watermarking survives the incidental processing images undergo — compression, resizing, screenshotting, platform re-encoding. It is considerably weaker against someone deliberately trying to remove it.
Published research has repeatedly demonstrated removal and, more concerningly, forgery — adding a watermark to an image that should not carry one, which would falsely mark a real photograph as generated. Treat watermark detection as a useful signal, never as proof.
The privacy trade-off
Provenance metadata is designed to persist, and persistent metadata is a privacy consideration.
| May be recorded | Implication |
|---|---|
| Creating software and version | Reveals your toolchain |
| Creation and edit timestamps | A timeline of your work |
| Signing identity | Can link work across accounts |
| Edit history | Shows what was changed and when |
| Ingredient chain | Reveals source images used |
For a news organisation, all of this is the point — attribution and verifiability are the goal. For a journalist working with a source, an activist, or anyone publishing pseudonymously, the same properties are a risk.
The specification anticipates this and allows redaction: assertions can be removed while the remaining manifest stays valid. Whether a given tool exposes that control is another matter, and mostly it does not.
✅ Decide deliberately
Keep credentials when attribution helps you — published journalism, commercial photography, anything where provenance is the value.
Strip them when the metadata itself is sensitive — the same exiftool -all= that removes AI prompts removes these too.
The point is that this should be a choice. Reflexively stripping everything removes a disclosure you may be expected to preserve; reflexively keeping everything publishes a work history you may not have meant to.
Where this leaves verification
C2PA is worth having and it does not answer "is this image real". A workable position:
- A valid manifest is meaningful evidence about origin, within the limits of the signing chain.
- No manifest is not evidence of anything. Most images do not have one.
- An invalid manifest is a genuine signal — the pixels no longer match what was signed.
- Verification is a chain, not a checkbox. Source, corroboration and context still matter.
The honest framing is that provenance raises the cost of undetected fabrication without making it impossible. That is a real improvement and it is not the solution it is sometimes presented as — and understanding which of those you are relying on matters more than the technical details above.
Inspecting or removing image metadata?
Strip EXIF, provenance and embedded generation data in your browser — the file is never uploaded anywhere.
Open the EXIF Remover →Summary
- C2PA attaches a signed manifest recording origin and edit history.
- The signature covers a hash of the pixels, so any change invalidates it.
- Absence of a manifest proves nothing. It is attestation, not detection.
- A screenshot removes it completely — inherent to metadata, not a bug.
- A valid signature proves a claim was signed, not that the claim is true.
- Soft bindings survive stripping but can be removed and forged deliberately.
- Manifests can carry identifying information. Strip or keep deliberately.
- It raises the cost of fabrication rather than preventing it.
Frequently Asked Questions
What are Content Credentials?
A cryptographically signed record attached to a file describing where it came from and what was done to it — which device or tool created it, which edits were applied, and by whom. C2PA is the open technical standard; Content Credentials is the consumer-facing name for it.
Can C2PA prove an image is not AI-generated?
No, and this is the most common misunderstanding. It proves what a signed manifest claims about an image that carries one. An image with no manifest is simply unknown — it could be a genuine photograph from a camera without C2PA support, or an AI image with the metadata stripped.
Does taking a screenshot remove Content Credentials?
Yes. A screenshot produces entirely new pixels in a new file with no manifest attached. This is the fundamental limitation of any metadata-based approach — the visual content survives the copy and the metadata does not.
What is a soft binding?
A perceptual fingerprint or invisible watermark embedded in the pixels themselves, used to look up provenance in a registry when the file's metadata has been lost. It survives re-encoding and screenshots better than metadata, and is more fragile against deliberate attack.
Should I strip Content Credentials from my images?
It depends what the manifest records. It can contain the creating tool, timestamps, edit history and sometimes an identity — genuine privacy considerations. It is also the mechanism by which your work can be attributed to you. Decide deliberately rather than stripping everything by reflex.