What Is C2PA? Content Credentials Explained

C2PA is an open technical standard for Content Credentials: a signed record, stored inside a photo, video or other file, that says which app or device made it and what was done to it, including whether AI was involved. The Coalition for Content Provenance and Authenticity maintains it, and its steering committee includes Adobe, Microsoft, Google, OpenAI, Meta and TikTok. Instagram and TikTok read this data when they decide whether to put an AI label on a post.

Check and scrub your file here

It runs in your browser. Nothing is uploaded, and the result is lossless.

Choose photos or videos

Drop files here or paste an image. Photo on your phone? Open scrubphoto.com there.

No upload. Works offline once the page loads.
Lossless. Every pixel kept, byte for byte.
Free. No sign-up, no limits.

No photo handy?

What is C2PA, and who runs it?

The coalition launched in February 2021. Microsoft's announcement named the founding members as Adobe, Arm, BBC, Intel, Microsoft and Truepic. It brought together two earlier efforts: the Adobe-led Content Authenticity Initiative and Project Origin, led by Microsoft and the BBC. The C2PA's own site describes it as a project of the Joint Development Foundation.

Today the C2PA home page lists its steering committee as Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic. TikTok moved up to the steering committee in July 2026. Samsung said in February 2025 that it had joined as a member.

The C2PA writes the specification. Content Credentials is the friendly name for what the spec produces, and the C2PA explainer calls it the preferred non-technical term for a C2PA manifest. When people search for "c2pa metadata", they mean the same data.

What a C2PA manifest holds

A manifest is a bundle with three layers. The C2PA specification defines each one:

Part	What it is	Example
Assertions	Statements about the file	Camera maker or lens, a crop, a thumbnail
Claim	A signed, tamper-evident list of those assertions	The app's name, version and operating system
Claim signature	The digital signature on the claim	Made with the private key of the app or device

Three kinds of assertion matter most for AI labels and privacy.

Actions record what happened to the file. The current spec requires a standard manifest to include either a created or an opened action, and each later edit can be logged as its own step.

The digital source type says where the content came from. The explainer says AI-performed actions are identified through this field, with values that mean things like "created by AI" or "edited with AI". IPTC metadata has a field with the same job, and Meta reads both.

Ingredients are the other files used to make this one, like the photo behind an edit or the pieces of a composite. When an ingredient is imported, the spec says a thumbnail of it should be stored if it does not already carry one.

Inside the file, the manifest has its own home in each format. JPEGs keep it in an APP11 segment, PNGs in a caBX chunk, WebP files in their own C2PA chunk, and MP4 or MOV videos in a uuid box.

How platforms use Content Credentials

Start with Meta. Facebook, Instagram and Threads label an image when its C2PA manifest or IPTC fields mark it as AI. On Instagram, that is the AI info label (Instagram has also shown it as AI content, and first called it Made with AI). If the file's data says AI edited the photo rather than made it, Meta has put the label in the post's menu since September 2024. The Instagram page covers how that plays out.

TikTok started reading Content Credentials on uploaded images and videos in May 2024 and labels AI content it finds that way. It writes its own manifests into AI content created on TikTok, and its November 2025 update added plans for an invisible watermark on uploads that carry them.

On Pinterest, LinkedIn, YouTube and X, a file with C2PA may show a Content Credentials or AI label. Check each platform's current help page for the details.

Content Credentials do not settle what is real. The Content Authenticity Initiative's how it works page says they are not meant to prescriptively indicate whether content is real. A genuine photo can carry a manifest because the app that edited it wrote one, and a file with no manifest proves nothing either way.

How to view Content Credentials and verify them

You have a few ways to look inside a file:

The ScrubPhoto checker runs in your browser with no upload. It shows whether C2PA is present, which app signed it, the digital source type, and a verdict for Instagram, TikTok and Facebook. It reports what the manifest says; it does not validate the signature.
Adobe's Inspect tool, part of Adobe Content Authenticity, at inspect.cr. The CAI's open-source docs describe uploading a file or pasting a link, and call it a C2PA conforming validator.
The CAI's Verify site at contentcredentials.org/verify, which the CAI describes as an inspection tool.
Adobe's Content Authenticity extension for Chrome, which Adobe said in April 2025 anyone can use to view credentials.

Use a validator when you need to know whether the signature holds up. Use the checker when you want to see what a photo will tell a platform before you post it.

What a C2PA manifest can reveal about you

Identity is optional by design. The CAI recommends applying Content Credentials on an opt-in basis and says identity details like the creator's name should always be optional. The core C2PA spec does not attribute content to people, though some communities build extensions that do.

Optional does not mean absent. Adobe Content Authenticity lets creators attach a name verified through LinkedIn, plus links to accounts like Behance, Instagram and X. Even with no name, a manifest can show the app and version you used, your operating system, and a step-by-step edit history.

Thumbnails deserve a second look. Because ingredients can carry their own small preview, cropping a photo does not necessarily remove the original framing from the record. Open sensitive files in a viewer before you send them anywhere.

Can you remove C2PA metadata?

Yes. The C2PA explainer answers the question directly: provenance metadata can be removed. The standard plans for that with soft bindings, meaning invisible watermarks or fingerprints, and with cloud storage that can match a file back to a stored manifest. So deleting the embedded manifest is not always the end of the trail.

ScrubPhoto removes the embedded manifest from JPEG, PNG, WebP, MP4 and MOV files without touching the pixels. The C2PA remover is the dedicated tool page, and our guide to removing Content Credentials from a photo walks through it. Watermarks are a separate layer. Google's SynthID, Meta AI's watermark and TikTok's invisible watermark live in the pixels or frames, which is why we wrote can you remove SynthID.

Removing data is also different from inventing it. ScrubPhoto never writes fake camera details into an AI image. Whatever a file says or no longer says, photorealistic AI video and realistic audio can still fall under platform disclosure rules.

Questions about C2PA and Content Credentials

What does C2PA stand for?

Coalition for Content Provenance and Authenticity. It is the group that writes the standard, and people also use C2PA as shorthand for the standard and the metadata itself.

Is C2PA metadata the same as EXIF?

No. EXIF is plain camera and software data that any app can edit. Content Credentials are cryptographically signed, which the CAI says makes them tamper-evident. One photo can carry both.

Does a Content Credential prove a photo is real?

No. It records what the signing app or device says happened to the file. The CAI says credentials are not meant to declare content real, and a missing credential does not make a file fake.

Why does my photo have Content Credentials if I didn't use AI?

Some apps and devices write a manifest for ordinary edits, not only AI ones. The digital source type and the actions list show whether AI was involved. Run the file through the checker to see what it says.

Is C2PA a watermark?

No. C2PA is metadata stored alongside the image data, so it can be removed. The standard can link to watermarks as a backup, but watermarks like SynthID are separate technology living in the pixels.

How do I verify Content Credentials?

Upload the file to a C2PA validator like Adobe's Inspect tool to check the signature. To see what a file contains without uploading it, use the ScrubPhoto checker.

Sources

Official pages this page was checked against in October 2026: