Guide

What is C2PA?

C2PA stands for the Coalition for Content Provenance and Authenticity. It develops an open technical standard for recording and verifying the provenance of digital content: information about where an asset came from and what happened to it over time.

The standard is used to create Content Credentials for media such as images, video, audio, and documents. Rather than trying to decide whether media is "real" by analyzing the pixels alone, C2PA provides infrastructure for producers and tools to attach verifiable provenance information to the asset.

What is a C2PA manifest?

A C2PA manifest is the structured provenance record associated with an asset. It can contain assertions describing parts of the asset's history, such as its creation, editing actions, software or devices involved, and other information the producer chooses to disclose.

The manifest is cryptographically bound to the asset and digitally signed. A verifier can therefore check whether the credential is still associated with the media it describes and whether the signed provenance data has been modified after signing.

How does verification work?

At a high level, a C2PA-enabled producer creates or updates a provenance manifest, signs it, and associates it with the asset. Later, a compatible verifier reads the manifest, checks the cryptographic relationship to the asset, evaluates validation information, and presents the available provenance to the user.

C2PA also maintains a conformance and trust ecosystem for implementations. This helps distinguish technical verification of a credential from the broader question of how much trust a user should place in a particular signer, workflow, or claim.

How does C2PA describe AI use?

C2PA can record declared creation and editing actions, including information indicating that AI was used in a particular step. Recent C2PA guidance emphasizes machine-readable provenance labels that can distinguish synthetic creation from later AI-assisted modification when the producing workflow records those actions.

This makes C2PA fundamentally different from an AI-image detector. It reports provenance supplied through a compatible workflow. It does not infer AI use from visual appearance, and it cannot guarantee that every AI-generated asset will contain a credential.

What does C2PA not prove?

A valid C2PA credential is not a universal certificate that an image is true, accurate, unbiased, or unedited. The standard is designed to verify provenance assertions and their integrity, not to assign a value judgment to the content itself.

Likewise, the absence of a readable C2PA manifest is not evidence that an image was created by a human. A file may never have received a credential, the credential may have been removed or become unavailable in a later workflow, or the current verifier may not support the way it is associated with the asset.

C2PA vs. Content Credentials

The terms are closely related but not identical. C2PA is the coalition and technical standard. Content Credentials are the provenance records and user-facing concept built on that standard. If you want the practical view of what a credential can contain and how to interpret one, see What are Content Credentials?.

How can I inspect C2PA data in an image?

Use the Image Provenance Checker to select an image in your browser. The current MVP checks supported C2PA Content Credentials separately from EXIF metadata and keeps the selected image on your device. A readable manifest is presented as provenance evidence; a missing manifest is not converted into a claim that the image is human-made.

For the standard itself, see the official C2PA website, the C2PA FAQ, and the C2PA resources.