The idea in one paragraph
Content Credentials are a signed record travelling inside an image file that says where the image came from and what has been done to it since. The record is created by whichever tool produced or edited the file, hashed against the pixels, and signed with a certificate. Anyone can read it. Anyone with a verifier can check that the signature is intact and that the pixels have not changed since it was applied.
The specification behind it is C2PA, from the Coalition for Content Provenance and Authenticity — a joint effort of Adobe, Microsoft, Arm, Intel, the BBC, Truepic and others, now with OpenAI, Google, Sony, Nikon, Leica and Canon involved. "Content Credentials" is the user-facing name for the same thing.
What is inside a manifest
A C2PA manifest is a small structured document embedded in the file. It contains four things that matter to a reader.
| Part | Contents | Example |
|---|---|---|
| Claim generator | The software that wrote the manifest | Adobe Firefly 1.0 c2pa-rs/0.28.2 |
| Assertions | Statements about the asset: origin, actions, ingredients, thumbnails | c2pa.actions, stds.iptc |
| Hard binding | A cryptographic hash of the image data | Ties the claim to these exact pixels |
| Signature | A COSE signature over the claim, plus the signing certificate | ES256, PS256, Ed25519 |
The actions list is the most readable part. It uses a fixed vocabulary, so you get a short history rather than a paragraph of marketing copy.
| Action | Meaning |
|---|---|
c2pa.created |
This asset was newly created by the claim generator |
c2pa.edited |
The asset was modified |
c2pa.placed |
Another asset was placed into this one |
c2pa.cropped, c2pa.resized, c2pa.color_adjustments |
Specific edits |
c2pa.converted, c2pa.transcoded, c2pa.repackaged |
Format changes |
c2pa.opened |
An existing asset was opened as the starting point |
An image generated by DALL·E and then retouched in Photoshop can carry both manifests: the Photoshop manifest references the earlier one as an ingredient, so the chain stays readable. That chaining is the real point of the standard — not a single yes/no flag, but a lineage.
Where the manifest physically lives
The manifest is wrapped in a JUMBF container (JPEG Universal Metadata Box Format) and then placed wherever the file format allows arbitrary boxes.
| Format | Location |
|---|---|
| JPEG | APP11 marker segments, split across segments if large |
| PNG | A caBX chunk |
| WebP | A C2PA RIFF chunk |
| AVIF, HEIC, MP4 | A jumb box in the ISO base media container |
| TIFF, DNG | A dedicated tag |
Because it is a normal metadata box, it is subject to the normal fate of metadata: anything that re-encodes the file without C2PA support drops it. That includes most social platforms, most screenshot tools and most quick "save for web" exports. See why Instagram strips image metadata.
What SynthCheck shows you — and what it does not
Drop a file into SynthCheck and it will find the JUMBF payload, pull out the claim generator strings, list the recorded actions, report the manifest size, and tell you whether signature structures are present.
It does not cryptographically validate the signing certificate. That step needs an up-to-date trust list of accepted issuers, revocation checking, and time-stamp validation. SynthCheck deliberately leaves that to a dedicated verifier and links you to contentcredentials.org/verify for it.
The practical difference:
- What SynthCheck tells you: this file contains a manifest that claims to have been produced by X, with actions Y and Z.
- What a full verifier adds: that claim was signed by a key belonging to an issuer on a known trust list, and the pixels still hash to the value in the claim.
For most day-to-day checking, the first is enough to answer "is this thing declaring itself as AI-generated?" — the wider workflow is in how to check if an image is AI-generated. For anything with consequences — publication, a dispute, evidence — do the second.
Hard bindings, soft bindings and durable credentials
A hard binding is the hash. Change one pixel and it stops matching, which is exactly what you want for tamper-evidence, and exactly what makes the credential fragile: a legitimate re-compression also breaks it.
Because of that fragility, the ecosystem is layering in soft bindings — invisible watermarks and perceptual fingerprints that survive re-encoding. Adobe calls the combination "durable" Content Credentials: metadata for the detail, a watermark to signal that a credential once existed, and a fingerprint to look the original manifest up in a cloud registry after the metadata has been stripped.
This is promising and not yet universal. Today, if the metadata is gone, the credential is gone for most practical purposes.
What a credential does and does not prove
| Claim | Supported? |
|---|---|
| "This tool wrote this manifest" | Yes, if the signature validates against a trusted issuer |
| "These pixels match the ones the claim covers" | Yes, via the hard binding |
| "This image is AI-generated" | Yes, if the manifest says so — generators declare it |
| "This image is NOT AI-generated" | No. A missing credential says nothing at all |
| "This photograph depicts a real event" | No. A signed camera capture proves capture, not truth about the subject |
That fourth row is the one to internalise. Absence of a Content Credential is not evidence of authenticity. Metadata is trivially stripped, most images in circulation have never had a credential in the first place, and screenshots start life with a completely clean slate.
How this connects to the law
Article 50 of the EU AI Act requires providers of generative AI to mark synthetic output in a machine-readable form, applying from 2 August 2026, with penalties up to EUR 15,000,000 or 3% of worldwide annual turnover. Systems placed on the market before that date have until 2 December 2026 for the marking obligation.
The regulation does not name C2PA. It asks for marking that is "effective, interoperable, robust and reliable as far as technically feasible". C2PA is the obvious candidate because it already exists, is cross-vendor, and is machine-readable by design — but IPTC DigitalSourceType tags and invisible watermarking are also on the table. More in EU AI Act Article 50 and image labelling.
FAQ
Can Content Credentials be faked? The manifest contents can be written by anyone, but a valid signature cannot be forged without the private key. That is why signature validation matters: an unverified manifest is an assertion, a verified one is an attributed assertion. Note also that a signature proves who signed, not that what they signed is true.
If I crop an image, do I lose the credential? In a C2PA-aware editor, no — the tool writes a new manifest recording the crop and referencing the original as an ingredient. In a tool with no C2PA support, usually yes: the metadata block is discarded and the chain ends there.
Do cameras write Content Credentials? Some do. Leica, Sony, Nikon and Canon have shipped or announced in-camera Content Credentials on specific bodies, usually as an opt-in setting. Coverage is still small compared with the number of cameras in use.
Does a Content Credential tell me if an image was generated with SynthID-watermarked models? Only if the manifest happens to mention it. SynthID is a pixel watermark, not metadata, and there is no public detector for it — see SynthID explained, and its limits. The two systems solve different halves of the problem and are meant to be used together.