What is C2PA? Content Credentials explained, read and removed
Content Credentials are turning up in photos, AI images, videos and PDFs. Here is what the C2PA standard is, how to read each part of a manifest, what the signature does and does not prove, and how to remove one when you need to.
You may have met Content Credentials without knowing it: a small "CR" mark on a LinkedIn image, an "AI info" label on Instagram, or a Firefly download that a checker says was "issued by Adobe". All of these come from the same place, a block of signed data embedded in the file under a standard called C2PA.
This guide explains what that block is, walks through each field you will see when you open one, sets out what the signature can and cannot tell you, and covers removal: how it works, what it costs and when you should keep the credentials instead.
What is C2PA?
C2PA stands for the Coalition for Content Provenance and Authenticity, a standards body founded in 2021 by Adobe, Arm, the BBC, Intel, Microsoft and Truepic, and since joined by Google, OpenAI, Meta, camera makers and news organizations. Its specification defines how to record where a piece of media came from and what happened to it, in a form that software can check. Content Credentials is the consumer-facing name for those records, usually shown with a small "cr" icon.
The record is written by whatever touches the file: a camera at capture, an editor when you export, an AI service when it generates. Each one can add a manifest, and the file keeps them together in a manifest store. The newest manifest is the active one; earlier ones survive as the history behind it.
What is inside a C2PA manifest?
A manifest is a bundle of statements, called assertions, plus a claim that lists them and a signature over the claim. These are the parts you will actually read:
| Part | What it tells you | Example |
|---|---|---|
| Claim generator | The app or service that wrote this manifest | "Adobe Firefly", "OpenAI", "Microsoft Designer" |
| Signer | The organization named on the certificate that signed it | "Adobe Inc.", or a camera maker |
| Actions | What was done to the content, in order | c2pa.created, c2pa.edited, c2pa.cropped, c2pa.converted |
| Digital source type | What kind of media it is, as an IPTC value attached to an action | trainedAlgorithmicMedia (AI-generated), digitalCapture (a camera) |
| Ingredients | The files this one was made from, often with thumbnails and their own manifests | A source photo placed into a composite |
| Hash binding | A cryptographic hash of the content the claim covers | Not shown to readers; a validator recomputes it |
The digital source type deserves a closer look, because it is what most "AI" labels key off. trainedAlgorithmicMedia means the content was created by a model trained on sampled media; compositeWithTrainedAlgorithmicMedia means a capture or edit with AI-generated parts, such as a generative fill; algorithmicMedia means made by an algorithm without training data. The standard also lets a manifest carry descriptive metadata of its own, so a credential can repeat details you thought lived only in EXIF.
What does the signature actually prove?
Two things, and only two. First, integrity: the claim includes hashes of the content and the assertions, so if a pixel or a statement changes after signing, a validator sees the mismatch. Second, identity: the signature is made with an X.509 certificate, so a validator can tell which organization signed and whether that certificate chains to a signer it trusts.
What it does not prove is that the statements are true. A manifest is the signer’s account of events. A trusted camera maker saying "captured by this camera" is strong evidence; a manifest from an unknown signer is just a claim with a name attached. And because the hash covers the content, an app that edits the picture without writing C2PA, but keeps the old manifest, leaves one that no longer matches, which validators report as such.
How do you read a manifest in a file?
- Drop the file into the metadata viewer. Images, PDFs, audio and video are all read in your browser.
- If a manifest is present, a Content Credentials (C2PA) card opens the AI & provenance group. Signed by is the certificate’s organization and Made with is the claim generator.
- Recorded actions lists each action with its source type. An AI-generated badge appears when any action declares an AI source type.
- Ingredients counts the source files referenced, and Manifest store shows how many manifests the file holds and how many bytes they take up.
Below the card, look for a "Provenance reference" row. That is the XMP property dcterms:provenance, which points either to the embedded manifest or to credentials stored online. A link to an online store matters, because those credentials live on a server, not in your file.
How do you remove Content Credentials?
Open the C2PA remover, drop your files and run the removal in AI & provenance only mode, which it starts in. The manifest store goes, along with the XMP link to it, IPTC AI labels, generator tags naming an AI tool and embedded prompts; camera details, copyright and location stay. Switch to Everything to strip all other metadata too. Either way nothing is re-encoded:
- Images are rewritten at the byte level, so the pixels are bit-for-bit identical.
- MP4, MOV and M4A in AI-only mode have the C2PA box neutralized in place, with no remux, which works on files of any size. Everything mode, and other containers, use a stream-copy remux.
- WAV and MP3 credentials are detected and dropped when the file is remuxed, with the audio copied unchanged.
- PDFs have the embedded manifest file removed in both modes; the pages are untouched.
The cleaned copy is inspected again before you download it, so you can confirm the card is gone. A C2PA checker will then report no credentials, rather than broken ones. That is the trade-off to weigh: once removed, the file can no longer prove where it came from.
Should you keep the credentials or remove them?
Keep them where provenance is the point: news photography, evidence, scientific images, and client work where traceability is part of the contract. Remove them from the copy you share when the manifest exposes more than you want, such as an account name, an edit history or ingredient thumbnails that show a version from before you cropped something out. In both cases, archive the credentialed original.
Frequently asked questions
Is C2PA the same as a watermark?
No. A manifest is metadata stored beside the content, which is why it can be removed without changing a pixel and why a screenshot does not carry it. A watermark is part of the content itself, whether visible or hidden in the pixels.
Can someone fake Content Credentials?
Anyone can write a manifest, but they cannot sign it as someone else without that signer’s private key. That is why the signer matters more than what the manifest says, and why a validator checks the certificate against a list of trusted signers.
Is it legal to remove C2PA from a file?
For your own files it is generally legal; Content Credentials are optional metadata. Stripping author or copyright information from someone else’s work to hide its origin can breach rules such as DMCA §1202 in the US, and some jurisdictions, China among them, prohibit maliciously removing AI-content labels. This is general information, not legal advice.
Will the file still open after the manifest is removed?
Yes. Software that does not understand C2PA ignores the manifest, so removing it changes nothing about how a file opens, plays or prints. Only apps and sites that display Content Credentials notice the difference.