Glossary · Technology
C2PA content credentials
Content credentials are a provenance record attached to an image, video or audio file that states how it was created and edited, signed so that any later change can be detected. The specification comes from the Coalition for Content Provenance and Authenticity (C2PA), founded in 2021 by Adobe, Microsoft, the BBC and others. They are the main standards-based answer to the question of whether a picture was captured by a camera or generated by a model.
Updated November 6, 2026 · 2 min read
What is in a content credential?
A manifest embedded in the file (or stored alongside it and linked by hash) lists assertions: the capturing device or generating model, the software used, the edits applied, and sometimes the creator's identity. Each manifest is signed with a certificate, and each edit by a supporting tool adds a new manifest chained to the last. A viewer can verify the signatures and show the history; a broken chain or a missing manifest means the history cannot be vouched for.
Who supports it?
| Where | Status |
|---|---|
| Cameras | Leica, Sony and Nikon models sign at capture; most phones do not yet, though Google and Samsung have announced support on flagship devices |
| Generators | OpenAI, Adobe Firefly, Microsoft and Google label generated images with credentials or compatible metadata |
| Editors | Adobe Photoshop and Lightroom, Capture One, several open-source tools |
| Platforms | LinkedIn, TikTok and some Meta surfaces display labels when credentials are present; many platforms still strip them on upload |
| Law | The EU AI Act requires machine-readable marking of generated content; C2PA is the leading method |
What does it prove, and what does it not?
- Present and valid: the file has not changed since the last signing tool, and that tool recorded the history. It does not prove the first capture was real if the chain starts at an editor.
- Absent: nothing. Most images on the web have no credentials, and a deepfake made with a tool that does not sign carries no mark.
- Stripped: re-encoding, screenshots and many upload pipelines remove the manifest, like EXIF metadata. The standard allows a soft binding, a perceptual hash lookup to a cloud copy of the manifest, to recover it.
How does it relate to face search?
Credentials describe how a file was made, not who is in it, so they do not help find where a face appears. They help after a search: a result with intact credentials tells you whether the image was captured or generated and whether it was edited, which is the question a reverse face search cannot answer. Face search engines strip metadata from uploads for privacy, so the searcher's own credentials are not retained either.
Questions
Does a missing content credential mean an image is fake?
No. Most real photos have none. A valid credential is evidence of origin; its absence is not evidence of anything.
Can a credential be faked?
The signature cannot be forged without the signer's key, but a chain can start at an editor that imported an already-fake image, so the first link matters. Verification tools show where the chain begins.
Sources
- 1.C2PA, Technical Specification (checked November 6, 2026)
- 2.Content Authenticity Initiative, About Content Credentials (checked November 6, 2026)
Entry reviewed November 6, 2026. Found an error? Tell us.
Related entries
- Concept Image provenance and metadata What EXIF metadata, platform identifiers and C2PA content credentials reveal about a photo, who strips them, and how provenance helps or fails when tracing an image.
- Term EXIF metadata EXIF metadata defined: the camera, time and location data embedded in photo files, what it can reveal, which platforms strip it, and how to remove it before sharing.
- Term Deepfake Deepfake defined: faces, voices and video synthesised or swapped by machine learning, how they are made and detected, and the laws that cover them.
- Term Perceptual hash Perceptual hash defined: an image fingerprint that survives resizing and compression, how it differs from other hashes and embeddings, and how StopNCII uses it.
- Law EU Artificial Intelligence Act and the ban on scraping faces EU AI Act Article 5(1)(e): the ban on untargeted scraping of facial images for recognition databases, in force since February 2025, fines up to 7% of turnover.
Cite this entry
FaceSearch Wiki editors. "C2PA content credentials". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/glossary/c2pa-content-credentials/