Guide
What Are Content Credentials (C2PA)? A Plain Guide
What Content Credentials are, how the C2PA standard labels AI and camera images, how to check them, and what they can and cannot prove about an image.
Last updated Nov 15, 2026
In 30 seconds: Content Credentials are a signed record attached to an image file that says which tool or device made it and how it was edited. They follow an open standard called C2PA. A valid credential is strong evidence of where a file came from. A missing credential proves nothing, because most apps and websites remove it.
| You see | It means | It does not mean |
|---|---|---|
| A valid credential naming an AI tool | That tool says it generated or edited the file | Nothing else was changed afterwards outside the record |
| A valid credential naming a camera | The device signed the capture | The scene itself was not staged |
| A credential that fails to verify | The file or record was changed after signing | The image is necessarily fake |
| No credential | Nothing either way | The image is real, or that it is AI |
What Content Credentials are
Content Credentials are the public name for provenance data defined by the C2PA standard. When a supporting app, camera or AI generator creates or edits an image, it can attach a manifest: a small record of who or what made the file, which actions were taken and when.
The manifest is cryptographically signed. If someone changes the image or the record later, the signature no longer matches, and a verification tool reports that. Think of it as a tamper-evident label rather than a lock.
Where C2PA comes from
C2PA stands for the Coalition for Content Provenance and Authenticity, an industry group founded in 2021 by companies including Adobe, Microsoft, Intel, Arm, Truepic and the BBC. It publishes the open technical standard; "Content Credentials" is the name used in apps and on the small "cr" label some sites show.
Support is growing across three groups:
- AI image generators, including OpenAI's, which add credentials to images they create.
- Creative software, such as Adobe's apps, which can record edits.
- Some cameras and phones, which sign photos at the moment of capture.
How to check an image for Content Credentials
You need the original file, not a screenshot or a copy saved from a social network.
- See if the file has a record. Our free image metadata viewer shows whether Content Credentials and other AI labels are present, in your browser.
- Use a verification tool. The Content Authenticity Initiative's free Verify site reads the manifest and checks the signature.
- Look at who signed it. A credential is only as trustworthy as the organisation that signed it. Check the name of the tool or device.
- Read the history. The record lists actions such as "created with an AI tool", "edited" or "combined with other images".
- Check for warnings. A signature that fails to verify means the file or record changed after signing.
Our AI image detector shows any Content Credentials it finds next to the detector score and the file's EXIF data, so you can compare the evidence in one report. The sample image report shows what that looks like.
What Content Credentials can and cannot prove
A valid credential is one of the strongest pieces of evidence you can get, but it has clear limits.
- It proves what the signer claims, not the truth of the scene. A camera-signed photo can still show a staged event.
- It can be removed. Most social networks, messaging apps and screenshots strip metadata, including credentials. That is why missing credentials prove nothing.
- Coverage is incomplete. Many AI tools and almost all older photos have no credentials at all.
- Editing outside the record breaks the chain. If an image was changed in an app that does not support C2PA, the history ends there.
Content Credentials, watermarks and EXIF compared
These three are often confused. They answer different questions.
| Content Credentials (C2PA) | Invisible watermarks | EXIF metadata | |
|---|---|---|---|
| What it is | A signed record attached to the file | A pattern hidden in the pixels, such as Google's SynthID | Plain text fields stored in the file |
| Survives screenshots | No | Often, up to a point | No |
| Can be faked | Hard to forge, easy to remove | Hard to add or remove | Easy to edit |
| Who can read it | Anyone with a verification tool | Usually only the company that added it | Anyone |
How Content Credentials fit with AI detection
Provenance and detection work best together. Content Credentials tell you what a tool says about a file; an AI image detector estimates what the pixels look like. When a valid credential exists, it usually tells you more than a detector score. When it is missing, which is most of the time, the other checks in our guide on how to tell if an image is AI generated matter more.
Frequently asked questions
Is C2PA the same as Content Credentials? C2PA is the technical standard; Content Credentials is the name apps use for records that follow it.
Does every AI image have Content Credentials? No. Some generators add them, many do not, and most platforms strip them on upload.
If an image has no Content Credentials, is it fake? No. Most real photos online have none, because the apps that shared them removed the data.