C2PA Explained: What Content Credentials Can Prove, and What They Cannot

When an image is disputed, software is sometimes expected to classify it as real or fake. C2PA addresses a different question: whether an asset carries a verifiable record of its provenance and recorded processing history.^[2]

A Content Credential can record creation, tools, edits and ingredients. Cryptographic bindings and signatures allow a validator to detect changes to protected material. The credential is evidence about the origin and history of a digital asset, not an automated verdict on the real-world truth of the scene it depicts.^[1]^[2]

A digital image carrying a signed provenance record from a camera through editing and publishing to inspection — C2PA follows the paperwork. It does not interview the witnesses.

C2PA, Content Credentials and CAI

C2PA is the Coalition for Content Provenance and Authenticity, which develops the technical standard. A C2PA Manifest is the structured provenance package associated with an asset, while Content Credential is the user-facing term for presenting that provenance. The Content Authenticity Initiative supports adoption and open-source tooling; the normative requirements are in the C2PA specification.^[1]^[2]^[5]

Checked on 13 August 2026, the current technical specification was version 2.4, dated April 2026. It includes support for additional formats and assertions and defines crJSON as a derived representation for evaluation and reporting; crJSON is not independently verifiable and does not replace a signed manifest.^[1]

Assertions, claims and signatures

Assertions describe information such as creation, editing actions, software, ingredients, timestamps and digital source type. Version 2.4 distinguishes created_assertions, for which the claim signer accepts responsibility, from gathered_assertions supplied by other components and not attributed to that signer.^[1]^[2]

A claim references assertions and the binding between the manifest and asset. A claim signature is the digital signature over that claim. Successful signature validation shows that the signed structure matches; it does not show that the signer independently witnessed every assertion or that the recorded history is complete.^[1]^[2]^[3]

Binding, validation and trust

A hard binding uses cryptographic hashes to connect the manifest to protected asset bytes or portions. A changed protected asset should fail the corresponding binding check. Soft bindings, including watermarks and perceptual fingerprints, can support discovery of remotely stored provenance after some transformations that remove embedded metadata, but they provide different matching properties from cryptographic hashes.^[2]^[3]^[6]

A validator can locate the manifest, recalculate bindings and referenced hashes, validate the claim signature, evaluate the signing certificate against configured trust information, and report assertions and validation results.^[1]^[2]

C2PA validation checks the asset binding, manifest signature, signer trust and recorded assertions as separate steps — One signature, several questions. A green tick should never be asked to do all the thinking.

A mathematically valid signature and a trusted signing credential are separate results. C2PA validation considers certificate chains, trust anchors, relevant times and revocation information.^[1]^[3]

Checked on 13 August 2026, the C2PA Conformance Programme stated that the official Trust List had launched in mid-2025, that the Interim Trust List was frozen on 1 January 2026, and that its live Conformance Explorer listed conforming products and trust lists.^[4] The programme describes conformance as assurance that products adhere to the specification and specified security requirements; coalition membership by itself is not a product conformance result.^[4]^[5]

What a validated credential establishes

Depending on its contents and validation results, a credential can show that a signed manifest remains bound to the inspected asset, identify the signing credential, distinguish created and gathered assertions, list declared actions or ingredients, and report binding, signature and certificate status.^[1]^[2]^[3]

It does not automatically prove that the depicted event occurred, that every assertion is complete or factually correct, that the signer acted honestly, or that an unsigned asset is fake or AI-generated. An asset may lack a credential because its creator did not use C2PA or because processing removed embedded data.^[2]^[3]^[7]

Durability, privacy and independent analysis

Uploads, resizing, format conversion and screenshots can separate an asset from an embedded manifest. C2PA’s security analysis treats removal as a threat, while independent analysis from the World Privacy Forum and UMBC examines privacy, trust management, validator behaviour and implementation limitations.^[3]^[7]^[8]

Durable Content Credentials combine secure metadata with optional watermarking or fingerprint services so that some transformed copies can be associated with remotely stored provenance.^[2]^[6] The World Privacy Forum notes privacy and identity implications in C2PA’s trust model; provenance fields and remote discovery therefore require context-specific decisions about collection, disclosure and correlation.^[7]

Cameras, creative tools and verification

Checked on 13 August 2026, Leica’s own product page described the M11-P as the world’s first camera with Content Credentials and listed several Leica models with the technology. This is a vendor claim, not an independently established priority claim.^[9] The relevant technical capability is that a capture device can begin a provenance record at capture.^[1]^[9]

Checked on 13 August 2026, OpenAI stated that it had added Content Credentials to supported image and video systems and described metadata as one part of a broader approach because uploads and transformations can remove it.^[10] Current product conformance should be checked in the live C2PA explorer rather than inferred from a vendor announcement or coalition membership.^[4]

A reproducible inspection

The C2PA project publishes the test image C.jpg with an embedded manifest, and the official Python SDK can read and validate manifests.^[11]^[12] The following file is byte-identical to the authoritative local inspect_c2pa.py used for the audit.

from __future__ import annotations
import json
import sys
from pathlib import Path
from c2pa import Reader
def inspect(path: Path) -> dict[str, object]:
    reader = Reader.try_create(path)
    if reader is None:
        return {"file": path.name, "credential": "not found"}
    report = json.loads(reader.json())
    manifest = report["manifests"][report["active_manifest"]]
    actions = [
        action["action"]
        for assertion in manifest.get("assertions", [])
        if assertion.get("label", "").startswith("c2pa.actions")
        for action in assertion.get("data", {}).get("actions", [])
    ]
    signature = manifest.get("signature_info", {})
    return {
        "file": path.name,
        "validation_state": report.get("validation_state"),
        "claim_generator": manifest.get("claim_generator"),
        "signer": signature.get("common_name"),
        "issuer": signature.get("issuer"),
        "actions": actions,
        "validation_status": [
            item["code"] for item in report.get("validation_status", [])
        ],
    }
for filename in sys.argv[1:]:
    print(json.dumps(inspect(Path(filename)), indent=2))

The exact command recorded for the local test was:

python inspect_c2pa.py C.jpg C-resaved.jpg

The script was executed on 13 August 2026 against the official sample and a JPEG produced by resaving it. The exact standard output was:

{
  "file": "C.jpg",
  "validation_state": "Valid",
  "claim_generator": "make_test_images/0.12.0 c2pa-rs/0.12.0",
  "signer": "C2PA Signer",
  "issuer": "C2PA Test Signing Cert",
  "actions": [
    "c2pa.created",
    "c2pa.drawing"
  ],
  "validation_status": [
    "signingCredential.untrusted"
  ]
}
{
  "file": "C-resaved.jpg",
  "credential": "not found"
}

The sample returned validation state Valid and signingCredential.untrusted. This demonstrates that binding and signature validation can succeed while trust in the signing credential remains a separate result.^[1]^[3] The resaved copy returned no discoverable credential in this test. That result does not establish manipulation or AI generation; it establishes only that this copy did not expose C2PA provenance to the reader used by the script.^[2]^[3]

Interpreting the result

C2PA validation reports separate facts about binding, signature, credential trust and recorded assertions. Presenting those results separately avoids treating one status indicator as a complete judgement about an asset.^[1]^[2]

The absence of a credential is neutral evidence while adoption is incomplete and processing can remove manifests. The presence of a credential calls for inspection of its validation status, signer and assertions rather than automatic acceptance.^[2]^[3]^[7]^[8]