What are Content Credentials (C2PA)?

A record the file carries about itself

C2PA stands for the Coalition for Content Provenance and Authenticity, the body that publishes the specification. What it defines is a small, cryptographically signed document that a camera or an editing tool can tuck inside a file. The industry name for that document, the one you will see in most interfaces, is Content Credentials.

The record describes production rather than content. A typical one names the tool that made the file, lists the actions taken on it — created, opened, resized, colour adjusted — and identifies whoever signed it. Some also declare how the content originated, including a specific term meaning that a generative model produced it.

It is stored the same way other metadata is: in a section of the file set aside for it. In a JPEG that is a run of APP11 segments, in a PNG a chunk named caBX, in an MP4 a box with a particular identifier. Nothing about it touches the picture or the video itself.

Present, readable, and authentic are three different things

This is the distinction that matters most, and the one most easily lost.

That a credential is present means only that some bytes shaped like one are in the file. That it is readable means those bytes decoded into fields that made sense. Neither says the record is true. A credential can be copied from one file onto another, written by software that simply asserts whatever it likes, or left in place while the image beneath it is replaced.

Establishing that a credential is genuine means checking its signature against a certificate, checking that certificate against a list of signers the world has agreed to trust, and recomputing hashes over the file to confirm the content still matches what was signed. That is a separate operation from reading it, and it needs infrastructure — a maintained trust list above all — that has to be kept current or it starts quietly giving wrong answers.

This tool reads credentials. It does not verify them, and it says so on every file that has one. Treat what it shows you as the file’s own claim about itself, quoted rather than endorsed.

What their absence tells you: almost nothing

Most files in circulation carry no Content Credentials at all, and that is unremarkable. The system is young, few tools write credentials, and the ones that do are a small share of everything that produces images and video.

Credentials are also fragile in ordinary use. Screenshotting a picture, re-encoding it, sending it through a messaging app that recompresses uploads, or opening and saving it in software that does not understand the format will all drop the record without anyone intending it. A file that had one an hour ago may not have one now.

So a file without a credential is not suspicious, and a file without one has not been shown to be anything. The useful question is what a file does carry, not what it fails to.

Removing one, and what removal does not do

Removing a credential is legitimate and often sensible. A signed record can name the software you use, the account that made it, sometimes a device — information you may not want to publish alongside a picture.

This tool treats removal as a separate decision from cleaning metadata, because they are separate acts. Stripping GPS coordinates and erasing the record of where a file came from are different things to want, and one is never done as a side effect of the other.

Two things removal does not achieve. It does not make a file appear to be an original: nothing about a file with no credential suggests it ever had one. And it does not reach anything held elsewhere — a manifest stored on a server, or a copy of the file someone else already has. When a file points at a credential stored remotely, this tool shows you the address and stops there, because requesting it would tell that server which file you are looking at.

What to do with what you see

Read a credential as a lead, not a verdict. A file naming a generative tool as its producer is telling you something worth knowing, and it is far more likely to be true than false — writing one is work that serves no purpose if the claim is invented. But it remains a claim.

Where the answer matters, use a validator built for the job, which will check the signature and the trust chain rather than only reading the fields. And where a file carries nothing, resist the temptation to read meaning into the silence.

Questions