What is C2PA (Content Credentials)? A plain-English 2026 guide

If you’ve seen a little “Cr” icon on an image, or read that a photo has “Content Credentials,” you’ve already met C2PA — usually without anyone explaining what it is. In plain terms: C2PA is an open technical standard for recording where a piece of media came from, and Content Credentials is the consumer-facing name for what that standard produces — a tamper-evident record, cryptographically signed and tucked inside the file itself, that says who made it, with what tool, and how it was edited along the way.

Think of it as a nutrition label for digital content. It doesn’t judge whether an image is “real” or “fake” — it carries a signed history you can check. This guide covers what C2PA actually is, who is behind it, how the signing works, what it looks like in files today, and — just as important — what it cannot prove.

C2PA vs Content Credentials: two names, one thing

The two terms get used interchangeably, but they aren’t quite the same layer. C2PA — short for the Coalition for Content Provenance and Authenticity — is the specification: the open, published standard that defines the file format, the cryptography, and the data model. Content Credentials is the brand and user experience built on top of it, the way “Bluetooth” is the friendly name for a wireless standard most people never read. When a tool says it adds Content Credentials, it means it embeds a C2PA manifest.

Who is behind C2PA?

C2PA is not one company’s pet project. It was formed in 2021 as a Joint Development Foundation project under the Linux Foundation, merging Adobe’s Content Authenticity Initiative (CAI) with Project Origin, an effort led by the BBC and Microsoft. The membership now spans the companies that make the tools generating and capturing media:

• Software & AI — Adobe (Photoshop, Firefly), OpenAI (DALL·E, Sora), Google, Microsoft and Meta.
• Camera makers — Leica, Sony, Nikon and Canon, the companies signing photographs at the moment of capture.
• Chips, media & verification — Intel, Arm, the BBC, Truepic and others across the pipeline.
• The Content Authenticity Initiative (CAI), Adobe’s sister community, now counts thousands of member organizations promoting adoption.

How Content Credentials actually work

A C2PA file carries an extra block of data — the manifest — riding alongside the pixels or audio. You never see it unless you look, but it has four moving parts worth understanding.

1. The manifest

The manifest is the container for everything provenance-related. A single file can hold a whole store of manifests — the newest describing the latest edit, older ones preserving each earlier state. It travels inside the image, video or audio file, not in some separate database you have to trust.

2. Assertions

Assertions are the individual statements a manifest makes: “created with Adobe Firefly,” “this is a thumbnail,” “these actions were taken.” One assertion matters more than the rest for AI detection — the IPTC digitalSourceType. When its value is trainedAlgorithmicMedia, that is the industry’s official, machine-readable way of saying “this was generated by an AI model.” It is the label a detector looks for first.

3. The signature and certificate

This is what makes C2PA more than editable metadata. The assertions are hashed and bound into a claim, and that claim is signed with a certificate issued to the signer — Adobe, OpenAI, a camera maker, or anyone holding a valid certificate. Change a single pixel or edit a field after signing and the hashes no longer match: the manifest fails validation rather than lying. Signed means verifiable, not unbreakable.

4. The ingredient chain (edit history)

When you open a signed image, edit it, and export, the original becomes an ingredient of the new manifest. Do that repeatedly and you build a chain — capture, crop, color-grade, export — each step signed, each linking back to the last. That is how Content Credentials can show not just who created a file but how it travelled from camera or model to the version in front of you.

What Content Credentials look like in real files today

This isn’t a future spec — signed provenance is shipping in mainstream tools right now, and you have probably already handled files carrying it:

• OpenAI DALL·E & ChatGPT images — downloads carry a C2PA manifest marking them as AI-generated.
• Adobe Firefly & Photoshop — Firefly generations and many Photoshop exports attach Content Credentials, including generative-fill edit history.
• OpenAI Sora video — Sora clips ship with a C2PA manifest, alongside a visible watermark on app downloads.
• Leica, Sony & Nikon cameras — the Leica M11-P was the first camera to sign photos at capture; Sony and Nikon added Content Credentials to pro bodies by firmware. These sign real photographs, not AI output.

What carries C2PA — and what quietly strips it

Here is the honest catch: a manifest only helps while it survives. This is the state of play for the files most people actually encounter.

Why C2PA matters now: the EU AI Act

Provenance used to be a nice-to-have. A law is about to make it a requirement. Article 50 of the EU AI Act — the transparency rules, applicable from 2 August 2026 — requires providers of generative AI to mark their synthetic output in a machine-readable way, and requires deployers to disclose deepfakes. The regulation doesn’t name a single technology, but C2PA is the leading implementation the industry is converging on, which is exactly why OpenAI, Adobe, Google and Microsoft are already shipping it. Expect the share of AI media that carries verifiable Content Credentials to climb sharply as the deadline lands.

The honest limits — what C2PA does not prove

Anyone selling C2PA as a fake-detector is overselling it. The standard is genuinely useful, but its boundaries matter more than its promises:

• It can be stripped. A screenshot, a re-encode, an export through a tool that doesn’t preserve it, or a platform that re-compresses uploads will remove the manifest. The pixels survive; the provenance doesn’t.
• Absence proves nothing. A file with no Content Credentials is not “verified human.” It might be a camera photo, a screenshotted AI image, or anything in between. No credential means no information — not innocence.
• It proves provenance, not truth. A perfectly valid manifest can sign a staged or misleading photo. C2PA tells you where a file came from and whether it was altered after signing — not whether the scene it shows is honest.
• It’s only as trustworthy as the signer. Verification confirms a certificate is valid and the content unaltered; it’s still on you to decide whether you trust whoever signed it.

How to verify Content Credentials yourself

You don’t have to take a platform’s badge on faith — the manifest is checkable, and checking it is free.

• Content Credentials Verify (contentcredentials.org/verify) — the CAI’s official web tool. Drop in an image and it reads the manifest, showing the signer, the AI and edit assertions, and the ingredient history.
• Aipurity’s in-browser checks — our image and video tools parse the signed C2PA manifest locally, in your tab, and lay out the same evidence with the honest caveats attached. Nothing is uploaded; the file never leaves your device.
• Look for the “Cr” pin — many apps now surface a small Content Credentials icon; clicking it opens the same underlying manifest data.

C2PA vs SynthID: allies, not rivals

You’ll often see C2PA mentioned next to Google’s SynthID, and it’s easy to assume they compete. They don’t — they attack the same problem from opposite ends. C2PA is signed metadata attached to the file: rich and human-readable, but removable by a screenshot. SynthID is an invisible watermark woven into the pixels, audio or text tokens themselves: it carries far less information and only Google’s own verifier can read it, but it survives many edits that would strip a manifest. One is a signed label on the outside of the package; the other is a dye mixed into the contents. Used together they cover each other’s gaps — which is why serious provenance stacks increasingly use both.

The bottom line

C2PA and Content Credentials are the most credible answer the industry has to “where did this come from?” — an open standard, cryptographically signed, already inside images from DALL·E, Firefly and Sora and photographs from Leica and Sony, and about to be pushed along by EU law. They are not a lie detector, and a missing credential tells you nothing. But when a valid manifest is present, it is the strongest, most checkable evidence of origin we have — which is precisely why reading it beats guessing at pixels.