What Is C2PA and Why It Matters

C2PA — Coalition for Content Provenance and Authenticity — is the open technical standard that lets an image or PDF carry cryptographically signed proof of where it came from and what was done to it. It's been adopted by Adobe, Microsoft, OpenAI, Google, BBC, Sony, Leica, and several other major content creators and platforms.

For someone handling a PDF or image, C2PA matters in three ways: provenance you can verify, transparency that travels with the file, and a privacy angle that isn't always obvious.

What the standard actually does

C2PA embeds a JUMBF box (a binary container) inside an image or PDF. The box carries:

• Assertions — formal claims about the file. "Generated by DALL-E 3 with prompt X." "Edited by Adobe Photoshop on 2026-08-15."
• Ingredients — references to source files. For an AI image, the prompt is an ingredient. For a composite, each constituent file is an ingredient with its own history.
• Signature — a cryptographic signature by the issuer. Anyone with the matching public key (in the C2PA trust list) can verify the manifest wasn't tampered with.

Every edit adds a new signed assertion. The chain is append-only.

Who's signed up

• OpenAI — every DALL-E 3 image and ChatGPT-native image generation carries a C2PA manifest
• Adobe — Firefly outputs, plus Photoshop adds C2PA when editing those outputs
• Microsoft — Bing Image Creator, Microsoft Designer
• Google — Imagen outputs
• Sony / Leica — certain camera models sign at capture time
• BBC — for editorial news images
• The Content Authenticity Initiative — a 4000+ member industry group backing the standard

Why it matters for typical document work

If your company exports a marketing image from Firefly, that image carries a C2PA manifest identifying Adobe Firefly as the generator. If a recipient wants to verify the image is authentic (not a deepfake), they can. For most marketing and editorial workflows, this is a positive.

For private workflows, it's a privacy consideration. The manifest may include:

• The exact prompt that produced the image
• Software versions
• A timestamp that reveals working hours
• A reference ID that ties back to a vendor

For most users, these aren't sensitive. For some — agencies under NDA, internal product teams, security-conscious organizations — they are.

The reader side

Reading a C2PA manifest requires either:

• A C2PA-aware viewer (Adobe products, some photo apps) — displays the assertion list inline
• A specialized inspector tool — extracts and displays the manifest bytes, shows signature validity, decodes ingredients

The AI Image Inspector on this site reads the C2PA manifest from any image you drop, displays the assertion list, and shows whether the signature is valid. It runs entirely in your browser; the image never uploads.

The strip side

If you don't want a C2PA manifest in your final file, strip it before publishing. The C2PA Stripper on this site removes all C2PA boxes from PNG, JPEG, and WebP images. It only touches metadata — pixels are preserved exactly.

For PDF, the PDF Compress tool doesn't yet strip C2PA — that capability is in progress. For now, use a desktop tool like exiftool: exiftool -all:all= file.pdf.

A balanced view

C2PA is a thoughtful piece of engineering. It solves a real problem (provenance in a world of deepfakes) without breaking file compatibility (the manifest is optional and ignoreable by readers that don't know it). For most users and most uses, it's a positive — you can verify the file came from where it says.

The only adjustment is that, if you produce files with prompts or internal references you don't want to publish, strip the manifest before publication. The standards support visible provenance as a default; your choice to remove it is also a legitimate one.

See also

• C2PA Content Credentials Glossary Entry — the deeper technical reference
• PDF Security and Privacy Hub — broader privacy posture
• Browser-Side vs Server-Side File Conversion — the architecture of in-tab tools