What do Content Credentials prove?
A source trail, not a verdict.

A Content Credential is a signed record about a media file.

C2PA uses the term Content Credential for a signed manifest about a media asset. A manifest can contain assertions about how the asset was created, which tools changed it, and which earlier files were used as ingredients. A content binding connects that record to the media, and a digital signature identifies the credential’s signer.

Think of it as a tamper-evident record of declared provenance. It is not a complete forensic log, and not every assertion comes directly from a camera or a person who made the original. The manifest can include information collected from other sources too.

Validation checks the record’s link to the file and its signature.

A credential-aware verifier checks whether the manifest is well-formed, whether its content binding matches the media, and whether the signature validates under that verifier’s trust rules. A successful result supports a precise statement: this provenance record is associated with this asset and has not been altered since it was signed.

Next, inspect who signed it. A verified signature identifies the credential or signer recognized by the validation system; it does not automatically identify the person who took the picture. Whether that signer deserves trust depends on the identity shown, the trust list used, and what you know about the organization.

A signed trail does not certify that a scene is accurate.

A credential can record that a particular device or service created a file, then show later edits. It cannot determine whether the camera was pointed at the right event, whether the caption gives the right date, or whether an assertion describes reality correctly. A genuine, unchanged photograph can still be misleading.

The C2PA specification itself warns that valid manifests can accompany misinformation. Use provenance as one piece of evidence, alongside source checking and independent reporting.

No credential does not mean no camera—or no truth.

Adding Content Credentials is optional. A file may have no credential because the camera or editing app did not create one. Metadata may also be removed when an image is resized, copied, uploaded, or edited with software that does not preserve it. Missing provenance is not evidence that an image is fabricated.

C2PA supports durable credentials that can sometimes be rediscovered through soft bindings such as a watermark or a media fingerprint. That can help find a record after metadata is separated from a file; it does not guarantee that every copy can be matched.

The C2PA 2.4 specification includes an AI disclosure assertion for recording declared information about AI use. It does not measure how much of an asset was generated, and its absence does not establish that AI was not used. Continue with the actual file, source, and context.

Read the provenance, then verify the claim.

1. Keep the original file when you can. Save where it came from and when you received it.
2. Use a credential-aware viewer and read the validation result, not just the presence of an icon.
3. Inspect the signer, its identity, the trust system used, and the actions or earlier ingredients listed.
4. Look for gaps: the visible history may not include edits made in software that did not preserve credentials.
5. Check the earliest source, date, place, and caption independently. Compare with other reliable reporting or records.
6. If no credential appears, keep checking the evidence. Do not label the media real or fake on that basis alone.

Open the Content Credentials verifier ↗

Continue to how to check an image’s origin and context ↗ and how to verify a video ↗. For AI-generated media and the rights around it, read the guide to AI authorship and copyright ↗.