What is C2PA and Content Credentials?
Tamper-evident provenance for images, explained
C2PA is an open standard for attaching a secure, tamper-evident record of origin to media. The consumer-facing name is Content Credentials. Here’s what it is, how it works and why it matters — then how to add and verify it.
What is C2PA?
C2PA (the Coalition for Content Provenance and Authenticity) is a technical standard, backed by companies like Adobe and Microsoft, that binds provenance information to a file using cryptographic signatures. The signed information is a manifest; the friendly brand is Content Credentials.
How does it work?
A manifest describing the asset (for example, that it was AI-generated, by which tool and when) is cryptographically signed and embedded in the file. If the image is later altered, the signature no longer matches, so tampering is detectable. A trusted timestamp records when it was signed, and any C2PA-aware tool — including the ExifGhost viewer — can verify it.
What is it for, and why do it?
- Provenance — show where an image came from and how it was made.
- AI transparency — mark AI-generated content in a machine-readable way (see labeling & the law).
- Trust — give viewers a verifiable signal instead of a claim that can be edited away.