By Joeri Westendorp, Product & Tech · Published 28 October 2026 · Updated 1 November 2026
Content Credentials are the everyday name for C2PA, an open standard for recording where a digital image or video came from and how it has changed. A credential is signed data, usually carried inside the image, so an unrecorded change to it shows up. It records provenance; it does not say whether what you are looking at is real, and that line is the whole point.
Content Credentials is the plain-language name for C2PA, the Coalition for Content Provenance and Authenticity. C2PA is an open standard, kept under the Linux Foundation, that a camera, an editor or an app can use to record where a piece of media came from and what has happened to it since. The data usually travels inside the image itself, though it can also be stored or referenced externally.
C2PA stands for the Coalition for Content Provenance and Authenticity. It was founded in February 2021 (opens in a new tab) by Adobe, Arm, the BBC, Intel, Microsoft and Truepic, and it brought two earlier efforts together: the Content Authenticity Initiative, led by Adobe, and Project Origin, led by Microsoft and the BBC. The coalition is run as a project of the Joint Development Foundation (opens in a new tab), part of the Linux Foundation (opens in a new tab), which is where the specification is written and kept.
Membership has grown well past those six. The steering committee today (opens in a new tab) brings together Adobe, Amazon, the BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic, with many more organisations as general members. That breadth is the point of a provenance standard: it is only useful if the tools that make images and the platforms that show them agree on the same format.
One distinction is worth clearing up, because the two names are easy to confuse. The standard is C2PA. The Content Authenticity Initiative, or CAI, is a separate community, led by Adobe, that promotes the idea and builds open tools for reading and writing this data. When a photo app adds Content Credentials, it is writing C2PA data.
The problem C2PA sets out to solve is easy to state. With today’s editing tools and AI image generators, the pixels on their own rarely tell you where an image came from or what has happened to it since. Looking harder at the picture rarely settles it, because the information was never in the pixels.
C2PA takes the opposite route. It records where a file came from at the moment it is made, and C2PA-aware tools record each change after that as a signed step, so the history travels with the file instead of being reconstructed from the pixels later.
The coalition is careful about the claim. Its own explainer frames C2PA as a way to verify the origins and history of digital content, and says in as many words that it is “not a cure-all for misinformation” (opens in a new tab). It is meant to sit alongside fact-checking and deepfake detection rather than replace them, and it is opt-in. A file can still be changed without its provenance being updated, which is exactly why a credential records a history rather than guaranteeing one.
A Content Credential is a set of statements, called assertions, about the asset: which device captured it, what edits were made, a small thumbnail, and a cryptographic hash of the content. Those assertions are bundled and digitally signed with a key held by the hardware or software that did the work. The signed bundle is the manifest, and the manifests on an asset together make up its provenance data.
That hash is what makes the credential tamper-evident. It binds the manifest to the content it protects, so if the protected content is changed without recording the change, the hash no longer matches and the change shows up when the credential is read. A credential can also record an edit as its own signed step, so a documented edit keeps a valid chain; it is the unrecorded change that breaks it. Think of a wax seal on a letter: it does not stop anyone opening the letter, but a change is hard to hide, because it breaks the cryptographic check.
Here is the part most coverage skips. A Content Credential records the history of a file, not the truth of a scene. The C2PA explainer is explicit about the limit: a credential offers no “value judgments about whether a given set of provenance data is ‘true’” (opens in a new tab) (C2PA and Content Credentials Explainer, version 2.4). It can carry a claim that a particular device recorded an image at a stated time, and make that claim checkable. It does not, on its own, independently prove the claim, because C2PA does not require every device to be independently attested. And it cannot tell you that the thing in front of the lens was real. A photograph of a screen is still a photograph.
The standard says the same about itself. Its authors frame provenance as something that works alongside media literacy, fact-checking and digital forensics, not as a replacement for any of them. That is the honest position, and it is the one worth repeating: knowing where an image came from is useful precisely because it is narrow.
When a tool reads a Content Credential it checks a few separate things: that the data is well-formed, that it has not been tampered with, that the signature is valid, and that the signer is trusted. Trusted has a specific meaning here. It means the certificate that signed the credential traces back to an authority on a known trust list.
So a signature can be valid and still be reported as valid but not trusted. That is not a problem with the image. It is a statement about the signer: the signature checks out, but the issuer is not on the list the tool consults. Reading those two apart, valid against trusted, is most of what it takes to use these tools well.
The C2PA Conformance Program keeps more than one list, and they are easy to confuse. The Conforming Products List (opens in a new tab) names the apps and tools that have passed evaluation, each at an assurance level. A separate trust list (opens in a new tab) names the certificate authorities allowed to issue signing certificates, so a validator can tell whether a signature used a certificate from a known issuer. A third list covers the time-stamping authorities that issue trusted timestamps. There are two assurance levels today, level 1 and level 2, with more planned, and a product’s certificate records the level it passed. One list is about which software was checked, and how closely; the others are about whom to trust to sign, and to stamp the time.
Content Credentials have moved out of the lab. You meet them, unevenly, along the chain from the camera to the feed:
Support is growing, and it is opt-in, so plenty of files still carry no credential at all. That is the picture of a standard on its way up, not a finished system. It is also why a missing credential tells you nothing on its own.
Content Credentials are fragile, through the habits of the wider web rather than the standard. Many platforms strip metadata when an image is uploaded, and re-encoding or a screenshot can drop the credential. Often there is then nothing left to read. Not always: a manifest can be stored separately and found again through a soft binding (opens in a new tab), a fingerprint or watermark computed from the content, which survives changes that would break the exact-byte hash. Either way the rule holds. A missing credential does not make an image fake, and a present one does not make it true. Absence is not evidence.
You do not have to take any of this on faith, which is the point. For an ordinary image, open a public C2PA verifier such as the Content Credentials Verify tool (opens in a new tab), upload the file or paste its address, and it shows the credential it finds, or tells you there is none. It recomputes the hash of the file in front of it and compares it to the one in the manifest, so a change to the protected content makes the check fail. For a complete EverStamp file, the verification page does the same in your browser and adds the checks that are specific to an EverStamp record. Neither asks you to sign in.
The phone signs each photo as it is captured, with a key that Apple or Google attests was made in its secure hardware. EverStamp then signs the C2PA Content Credential in the image itself, with EverStamp’s certificate. EverStamp for iOS and Android are listed on the Conforming Products List at assurance level 1, so another party can read those credentials with ordinary public C2PA tools. The time that counts is a separate step: an independent qualified timestamp is applied when the file is closed, not at the moment of capture.
Recording provenance when the image is made, rather than trying to detect a fake afterwards, is the deliberate choice behind the product. Detection afterwards has to catch up with every new generator; provenance at the point of capture is the other end of the same problem. A date on a photo is the smaller cousin of this idea, and worth understanding on its own (linked below).
No. They record where an image came from and whether it has changed since, not whether the scene in front of the camera was real. The C2PA explainer is explicit that the data carries no judgment about whether it is true. A photo of a screen is still a photo.
Often only that there is nothing to read. Many sites strip this data when an image is uploaded or re-encoded, though a manifest stored separately can sometimes be found again. A missing credential does not make an image fake, and a present one does not make it true.
C2PA is the open standard, kept under the Linux Foundation. The Content Authenticity Initiative is a separate, Adobe-led group that promotes the idea and builds tools. The standard is C2PA; the CAI uses it.
Yes. Every photo the app records carries a C2PA Content Credential. The phone signs the photo with its own key, and EverStamp signs the Content Credential with EverStamp’s certificate. EverStamp for iOS and Android are on the C2PA Conforming Products List at assurance level 1. An independent qualified timestamp is added when the file is closed.
C2PA, the Coalition for Content Provenance and Authenticity, was founded in 2021 by Adobe, Arm, the BBC, Intel, Microsoft and Truepic, bringing together the Content Authenticity Initiative and Project Origin. It is run as a project of the Joint Development Foundation, part of the Linux Foundation, and its steering committee now includes Adobe, Amazon, the BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic.
A growing, uneven set. Cameras such as the Leica M11-P sign at capture, Google’s Pixel 10 signs photos in its camera app, Adobe Firefly and ChatGPT mark images they generate, Photoshop can attach an edit history on export, and platforms such as LinkedIn and YouTube can show a label. It is opt-in, so many files carry no credential at all.
Why a date on a photo is only a claim, and what an independent timestamp adds.
Read more →The chain from the camera to the recipient, and what the verification page checks.
Read more →The free verification page, in the browser, for a file you have received.
Read more →