Updated: September 3, 2026 · Docs · Clothoff AI Editorial Team
What is C2PA?
A glossary entry on the Coalition for Content Provenance and Authenticity, the signed manifests it defines, and what a Content Credential can and cannot prove.
Educational glossary entry by a review publisher; not legal advice.
What are the parts of a Content Credential?
C2PA is the Coalition for Content Provenance and Authenticity, a standards body that publishes an open specification for recording the origin and edit history of media in a signed, tamper-evident record. The consumer name for that record is Content Credentials. Version 2.2 was released in May 2025 and version 2.4 in April 2026.
The specification uses a small vocabulary. The table maps each term to what it stores and why it matters when you check an AI-generated picture.
| Term | What it is | Why it matters |
|---|---|---|
| Manifest | A signed set of assertions about one version of an asset | The unit a verifier validates |
| Manifest store | All manifests attached to a file, latest one active | Shows the chain of edits |
| Hard binding | Cryptographic hash of the asset bytes | Detects any pixel change |
| Soft binding | Fingerprint or watermark that survives re-encoding | Recovers credentials after metadata is stripped |
| Assertion | A statement such as “created by generative AI” | Carries the synthetic label |
How does a Content Credential work?
When a camera, editor or AI model saves a file, it writes a manifest: assertions about the tool, the action and the ingredients, plus a hash of the content. The manifest is signed with the tool maker’s certificate, so a verifier can confirm both who signed and whether the bytes changed afterward.
Each later edit adds a new manifest to the store rather than rewriting history. A viewer that understands the format shows the chain: generated here, cropped there, exported by that application. Nothing in the record says whether the picture is “true”; it says where the file came from.
What can C2PA not prove?
A missing credential is not evidence of manipulation. Most social networks and messaging apps strip metadata on upload, and screenshots never carry it. The 2.2 specification answers this with soft bindings, which let a service look up credentials by fingerprint, but that only works where such a registry exists.
A credential also relies on the signer. If the signing tool declares an image as a photograph while it was generated, the record is signed and valid but wrong. The trust list of approved certificates is therefore as important as the cryptography.
How is it used in our reviews?
Our Responsible AI principles ask reviewed services to label synthetic output. During tests we check whether a downloaded image carries a manifest, whether the assertion names generative AI, and whether the credential survives the service’s own export path.
Adoption is uneven among the tools we cover: most write no manifest at all, and none we have tested implements soft bindings. Where the EU AI Act Article 50 marking duty applies from August 2, 2026, a signed credential is one of the accepted machine-readable methods.
“This is the preferred non-technical term for a C2PA Manifest. The C2PA Manifest Store therefore represents the Content Credentials of an asset.”
— C2PA Technical Specification 2.2, section 2.3.6 “Content Credential”, accessed September 3, 2026
Consent Note
This site is a publisher: it reviews third-party tools and does not create, edit, accept or store images. Docs entries are general information, not legal advice.
Sources
All sources accessed on September 3, 2026; educational entry, not legal advice.
FAQ: C2PA
Is C2PA the same as Content Credentials?
Not exactly. C2PA is the coalition and the technical specification; Content Credentials is the consumer-facing name for the signed manifest that the specification defines. In everyday writing the terms overlap, and the specification itself says Content Credentials is the preferred non-technical term for a manifest.
Which version of the C2PA specification is current?
The specification site lists version 2.4, dated April 2026, as the latest release; it adds a JSON serialization and new asset formats. Version 2.2, from May 2025, introduced the soft-binding model that many implementers still target. Older 1.x versions remain online for reference.
Can a Content Credential be faked?
The signature cannot be forged without the signer’s private key, and any change to the pixels breaks the hard binding. What can be wrong is the content of the assertions if a signer lies or is careless. Verifiers therefore check the certificate against a trust list before showing a credential.
Why do most images online have no credential?
Because metadata is fragile. Screenshots never contain it, and many platforms remove it during upload to save space or protect privacy. The absence of a credential says nothing about authenticity. Soft bindings and registries are the specification’s answer, but they depend on services adopting them.
Do undress apps add Content Credentials?
In our testing most do not, and none we have reviewed implements soft bindings. A few general image platforms write manifests on export. We note the observed behavior in each review because a synthetic label protects anyone who might later see the image without context.
Does C2PA satisfy the EU AI Act marking duty?
Article 50 requires providers to mark synthetic output in a machine-readable, detectable way that is effective and interoperable as far as feasible. A signed C2PA manifest with a generative-AI assertion is one recognized method, often combined with a watermark so the label survives metadata stripping.