What Are Content Credentials (C2PA)?
Last updated · 6 min read
Quick answer
Content Credentials are signed data inside a file that say how it was made and changed. The open standard behind them is C2PA. Cameras, editors and AI tools add them, and sites such as LinkedIn show them. You can view them with a checker and remove them from the file.
What Content Credentials are
The Coalition for Content Provenance and Authenticity (C2PA) publishes an open standard for the origin and edit history of digital content. The standard is called Content Credentials. A single credential is also called a C2PA manifest.
The C2PA Explainer describes a manifest as a set of statements about a file that are digitally signed. If anyone changes the file or the statements afterwards, the signature check fails.
Who is behind C2PA
The C2PA website (2026) lists these members of its steering committee: Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic. Their products add or read the credentials.
What a manifest contains
| Part | What it holds |
|---|---|
| Assertions | Statements about the file: where it came from, what edits were made with which tools, and whether AI was used |
| Hashes | A cryptographic fingerprint that ties the manifest to the image |
| Signature | A digital signature by the software or device that made the claim, so others can check who signed |
| Ingredients | Records of source files that went into the image, with their own credentials when they exist |
For an AI image, the record of the action carries a digitalSourceType field that marks the work of an AI system (C2PA Explainer). Names of people are not part of the core standard. A creator can add them with extensions, so the credential does not always say who made the image.
Where Content Credentials are stored
Most tools embed the manifest in the file. The standard also allows a link to the credential through a "soft binding", such as an invisible watermark or a fingerprint lookup. That makes it possible to find a credential in cloud storage after it is gone from the file (C2PA Explainer).
Adobe is one example. Adobe says the credentials of Firefly images are attached to the file and may also be stored in its public Content Credentials cloud, so its Inspect tool can recover them (Adobe Help Center, 2026).
Where you see them
- LinkedIn: a small C2PA icon on images and videos with signed credentials. A click shows the assertion about AI use, the app or device, who created it, who issued the credential and when (LinkedIn Help).
- Instagram, Facebook and Threads: Meta labels content as "AI info" when it detects industry-standard indicators, such as C2PA and IPTC data, or when a person says the content is AI-generated (Meta, 2024). Google said in May 2026 that Meta will also label camera-captured media with Content Credentials on Instagram.
- Gemini: since May 2026 the Gemini app can check Content Credentials. Google said Search and Chrome would follow (Google, 2026).
- Cameras and phones: Google says the Pixel 10 was the first smartphone to add Content Credentials in its native camera app (Google, 2026).
How to view them
- Open the AI metadata checker. It reads the file in your browser, and WipePic does not upload your photos.
- Use Content Credentials Verify or Adobe's Inspect tool. These are online services, so check their privacy terms first.
Use the original file. A screenshot makes a new image without the manifest.
What removing Content Credentials does
If you remove the manifest, viewers find no credential in the file. A site such as LinkedIn has nothing to read, so it shows no icon for the file. The image looks the same.
Removal has limits:
- A copy of the credential that a service stored in the cloud is not in your file. WipePic cannot delete it.
- Pixel watermarks such as SynthID stay. See Does Removing Metadata Remove SynthID?
- A platform can still label content when a person says it was made with AI.
To remove Content Credentials with WipePic, open Remove Content Credentials. WipePic does not re-encode the image, so the pixels do not change. If you want to keep proof of origin, keep the original file and share a cleaned copy.
What Content Credentials do not prove
The C2PA Explainer says provenance data does not tell you whether the content is true, accurate or factual. It only records where a file came from and what happened to it. It also says that trust depends on the signer and your own judgment, not on the presence of a credential alone.
Sources
C2PA and Content Credentials Explainer (C2PA, specification version 2.3); C2PA website (2026); LinkedIn Help, Content credentials; Meta, Our approach to labeling AI-generated content (2024); Google, tools to understand how content was created (May 2026); Adobe Help Center, Content Credentials overview (2026).
Questions
Are Content Credentials the same as C2PA?
Almost. C2PA is the open standard. A Content Credential is the preferred plain name for a C2PA manifest, which is the signed record inside a file (C2PA Explainer).
Do Content Credentials prove that an image is true?
No. They show where a file came from and whether it changed after signing. They do not show that the scene is real or that the signer is trustworthy.
Does a missing Content Credential mean an image is fake?
No. Adding Content Credentials is optional, and everyday actions such as a screenshot or a format change remove them. The C2PA Explainer says it does not want media without credentials to be seen as always less trusted.
Can I remove Content Credentials from my photo?
Yes. WipePic removes C2PA manifests from the file in your browser. It cannot remove copies that a service stored elsewhere, and it cannot remove pixel watermarks.
Is it safe to upload a photo to a Content Credentials viewer?
Online viewers receive the file that you give them. Read the privacy terms of each viewer before you use a private photo. The WipePic checker reads the file in your browser.
Remove the metadata from your photos
Free. In your browser. Your photos do not go to a server.
Clean a Photo