What Is C2PA Content Credentials?
C2PA — Coalition for Content Provenance and Authenticity — is an industry standard for embedding cryptographically signed provenance metadata into media files. When you open an image exported from ChatGPT, Adobe Firefly, or Microsoft Designer, you’ll see a C2PA manifest carried inside the file structure. That manifest names the creator, names the tool, and timestamps the creation — and the signature makes it provable rather than asserted.
The standard is technical, but the question it answers is straightforward: where did this file come from, and what was done to it?
What’s inside a C2PA manifest
A C2PA manifest is a structured blob (technically a JUMBF box) embedded alongside the pixels in the image file. It carries:
- Assertions — formal claims about the file. “This image was created by DALL-E 3 using prompt X.” “This PDF was edited by Adobe Acrobat at time T.” “These two photos were combined.”
- Ingredients — references to the source files. If the final image was generated from a text prompt, the prompt is an ingredient. If it was composited from three photos, each photo is an ingredient with its own provenance history.
- Signature — a cryptographic signature by the issuer’s private key. Anyone with the matching public key (listed in the C2PA trust list) can verify that the manifest was not tampered with after signing.
Together those three form a verifiable chain. Every edit adds a new signed assertion; no edit deletes history.
Who signs
C2PA maintain a public trust list of certificate authorities that can sign valid manifests. Founding technical members include Adobe, Microsoft, BBC, Intel, Arm, and Truepic. OpenAI joined in 2024 and Google in 2025.
In practice, the systems that produce signed manifests today include:
- ChatGPT / DALL-E 3 (OpenAI)
- Microsoft Designer / Bing Image Creator
- Adobe Firefly (every export)
- Google Imagen (Gemini)
- Sony and Leica cameras that sign at capture time
- Various smaller tools through the Content Authenticity Initiative
How to read one
Most viewers ignore C2PA. Photoshop surfaces C2PA through the “Content Credentials” panel. Photo apps from the major platforms are gradually building support. For programmatic inspection without uploading, use the AI Image Inspector — it reads the manifest and shows each assertion, ingredient, and the signature verification status, all in your browser.
How to strip one
A few legitimate reasons to strip a C2PA manifest:
- You’ve edited the image substantially, and the original provenance no longer reflects what the file is
- You want a clean file for delivery
- Privacy: the manifest may contain the prompt you used, which sometimes has personal content, client names, or unreleased ideas
The C2PA Stripper removes all C2PA boxes (and any other JUMBF metadata) from PNG, JPEG, and WebP files. It only touches metadata — pixels are untouched.
If you also want to disrupt the pixel-side watermarks some vendors embed (Google’s SynthID, Stable Diffusion’s dwtDct), the SynthID Sanitizer and the Universal AI Cleaner cover those layers.
A note on privacy
C2PA itself is metadata — it does not change image content. The manifest can be removed (legitimately or not) and the pixels remain. C2PA’s premise is that provenance is opt-in to read but standardized to write. If you don’t want a C2PA manifest in the image you publish, strip it before publishing.
See also
- Difference Between PDF and Word — when you need to understand document formats more broadly
- Strip Image Metadata — for full metadata wipe beyond just C2PA
- EXIF Extractor — for the older EXIF/XMP/IPTC metadata that often coexists with C2PA