How-ToGuide
How to Check an Image's Content Credentials (C2PA)
Some cameras, phones, editing apps and image generators now attach Content Credentials to the files they produce: a signed record of where the image came from and what was done to it. Checking for one takes a minute in a browser. Reading the result correctly takes a little longer, because a credential proves less than people assume, and a missing one proves almost nothing.
On this page
What Content Credentials are
C2PA is an open technical standard for attaching provenance to media. A credential, called a manifest in the specification, holds a set of assertions: statements about the file, such as the device or software that created it, edits made afterwards and whether generative AI was used. The manifest is cryptographically signed and bound to the image's content, so changing either the pixels or the record breaks the match. The C2PA explainer is explicit about the limits: credentials make no value judgment about whether the provenance data is true, only whether it is well formed, free from tampering and signed by a party on a known trust list.
| Result | What it means | What it does not mean |
|---|---|---|
| Valid credential, trusted signer | The record is intact and was signed by a known organisation's tool | That the scene is real or the caption honest |
| Credential declares AI generation | The signing tool recorded that the image was generated or edited with AI | That other images without the label are not AI |
| Credential present but invalid | The file or record changed after signing, or the signer is not trusted | That the image is fake; ordinary edits can break it |
| No credential found | Nothing was attached, or it was stripped | Anything at all about authenticity |
Check an image
Get the original file
Download the image itself rather than taking a screenshot. A screenshot creates a new file with none of the original's data. Images saved from social feeds have often been recompressed and stripped, so ask for the file directly from the source if you can.
Open the verify page
In your browser, go to contentcredentials.org/verify. It is a public page for reading C2PA data and needs no account.
Drop the file onto the page
Drag the image in or use the file picker. The page reads the embedded manifest if there is one and, where supported, looks for a matching credential using the image's content.
Read the summary
Look at who issued the credential, the date it was signed, the apps or devices listed, and any statement about AI. If the image was made from other images, the page may show those ingredients too.
Check the signer, not just the badge
A credential is only as meaningful as the organisation that signed it. A news agency's camera signature says something different from an unknown tool's.
Record what you found
Save a note or screenshot of the result with the date. Verification pages and trust lists change, so a record of what you saw is useful later.
Why most images show nothing
Content Credentials are still new and optional. Most cameras and phones in use do not sign images, and many websites and messaging apps remove embedded data when you upload. The C2PA explainer describes soft bindings, such as invisible watermarks and fingerprints, that can let a credential be found again in cloud storage after it has been stripped from the file, but support is uneven. NIST's 2024 overview of digital content transparency, which covers provenance, watermarking and detection, reaches the same practical conclusion: each technique has limits, and none should be treated as proof on its own.
Where this fits with other checks
- Read the ordinary metadata too. EXIF data can show a camera model, time and place, though it is easy to edit. Learn to read a photo's EXIF and location data.
- Do not confuse this with AI detectors. Detection tools guess from patterns; a credential is a signed record. The guide on how AI text detectors reach a score explains why guesses are weak evidence.
- Look for the source. A reverse image search and the original publisher's page are still the most useful checks for a news photo.
- Know your own laptop. Some built-in AI image tools add credentials to what they produce. The guide to which AI features on your laptop send data out lists where they live.
For more walkthroughs on checking and sharing files safely, see the full list of laptop how-tos.
Common questions
Does a Content Credential prove a photo is real?
No. It proves the record attached to the file is intact and was signed by a particular tool or organisation. It says nothing about whether the scene was staged or the caption honest.
Does a missing credential mean an image is fake or AI-generated?
No. Most genuine photos have no credential, and stripping one is easy. Absence is not evidence either way.
Can I add Content Credentials to my own photos?
Some cameras, phones and editing apps can sign images you create. Check your app's export or settings for a Content Credentials option.
Does a credential reveal my identity?
It can include a creator name if the app adds one. The C2PA explainer notes that the specification does not require the identity of a person, so check what your app includes before sharing.
Will editing an image remove its credential?
Editing in an app that supports C2PA adds a new entry to the history. Editing in one that does not, or taking a screenshot, usually drops the credential.
Sources
- C2PA: C2PA and Content Credentials Explainer: what a manifest holds and what validation does not judge.
- C2PA: Verifying Media Content Sources: the open provenance standard and its steering coalition.
- Content Credentials: Verify: public page for reading c2pa data in a browser.
- NIST: AI 100-4, Reducing Risks Posed by Synthetic Content: limits of provenance, watermarking and detection.