What Is C2PA?
Published June 2, 2026
C2PA stands for the Coalition for Content Provenance and Authenticity — a technical standards body founded by Adobe, Microsoft, Intel, the BBC, and others, and now part of the Linux Foundation's Joint Development Foundation. It publishes an open specification for attaching tamper-evident, cryptographically signed history to digital media: photos, videos, and audio.
What C2PA actually standardizes
At its core, C2PA defines a manifest format: a structured record that can be embedded inside a media file describing things like:
- What software or device produced or edited the file
- What actions were taken (captured, edited, composited, generated by AI)
- What earlier files ("ingredients") contributed to it
- Who or what signed the manifest, and when
That manifest is cryptographically signed, so if the underlying file is altered without going through C2PA-aware tooling, the signature no longer matches and the manifest can be flagged as invalid.
You'll often see C2PA-generated data called Content Credentials — that's Adobe's consumer-facing brand name for the same underlying C2PA manifest technology. Our C2PA & Content Credentials Checker reads exactly this data.
What a manifest can tell you
When a file has a valid, signed manifest, you can typically see:
- The claim generator — the software that created the claim (e.g. a specific camera app, editing tool, or AI generator)
- Assertions — structured claims about what happened to the asset
- Ingredients — references to source files used to produce this one
- Signature information — who signed it and when, and whether that signer is recognized as trusted
What C2PA does not do
This is the part that's easy to get wrong, so it's worth being direct:
- A manifest is not proof of truth. It records claims made by whoever generated it. A dishonest actor can still write false claims into a manifest, just as someone can lie in a caption.
- Absence of a manifest proves nothing either way. Most cameras, phones, and AI tools don't write C2PA data at all. Most social platforms also strip embedded metadata, including C2PA manifests, when you upload media — so a shared/re-uploaded file will often show no manifest even if the original did.
- A valid signature only confirms the manifest wasn't tampered with after signing — not that the content itself is authentic, unedited, or non-AI.
- Removing a manifest is possible. Because C2PA data lives in specific parts of a file (like the APP11 segment in JPEG, or dedicated boxes in video containers), it can be stripped — see our Metadata Cleaner — just like any other embedded metadata.
Why it still matters
Despite those limits, C2PA is one of the few standardized, cross-industry efforts to make media provenance verifiable rather than purely trust-based. As adoption grows across cameras, editing software, and AI generation tools, checking for Content Credentials becomes one more useful signal — not a final verdict — when trying to understand where a piece of media came from.
If you want to check whether a specific file carries this data, try the C2PA & Content Credentials Checker, which reads manifests entirely in your browser using the official open-source c2pa-web SDK — your file is never uploaded.