C2PALab

What Is C2PA?

Last updated 2026-09-10
Dynamic facts verified 2026-09-12

Quick answer: C2PA (Coalition for Content Provenance and Authenticity) is an open technical specification for representing content provenance. Participating tools can sign provenance information, such as recorded actions, ingredients, and declared digital source types, so a compatible viewer can inspect it and validate applicable bindings. C2PA is not an AI detector or a general-purpose truth detector.

The coalition and the standard

C2PA stands for the Coalition for Content Provenance and Authenticity, the organization behind an open technical specification for verifiable content provenance. The term "C2PA" is also commonly used to refer to that specification and its broader technology ecosystem.

The work is organized under the Joint Development Foundation. Organizations participating in or contributing to the ecosystem have included Adobe, BBC, Google, Intel, Leica, Microsoft, Nikon, OpenAI, Sony, and others. Participation and governance can change, so the coalition's own materials are the authoritative source for current membership.

That specification defines how provenance information is represented, stored, signed, discovered, and validated. "Content Credentials" is the user-facing name for the provenance records and experiences built on that model.

The standard is maintained openly and continues to evolve. For the latest normative details, always refer to the current official C2PA specifications rather than relying on a third-party summary.

The problem C2PA addresses is practical: media can pass through cameras, editors, generators, publishers, and sharing services without preserving an inspectable account of what happened. C2PA provides a common way for participating tools to declare, sign, and expose that provenance.

How C2PA works

C2PA is designed to follow an asset through supported production workflows, not to act as a one-time stamp:

CAPTURE OR CREATE
  |
  v
DECLARE PROVENANCE
  |
  v
SIGN MANIFEST
  |
  v
EDIT OR COMPOSITE
  |
  v
ADD NEW PROVENANCE
  |
  v
SIGN AND EXPORT
  |
  v
PUBLISH OR SHARE
  |
  v
INSPECT AND VALIDATE

When a later step is C2PA-aware, it may preserve relevant evidence or reference an earlier asset as an ingredient. Provenance can then accumulate across supported workflows instead of every export being treated as an isolated file with no history.

Manifests, claims and assertions

A C2PA Manifest is the structure used to carry a Content Credential's provenance information, including its claim, assertions, ingredients, and related signing information. It may be embedded in the asset or associated with the asset through a supported discovery mechanism.

A claim describes the provenance information and references the assertions that belong to that claim. The claim is protected by a digital signature. Assertions can record structured provenance such as actions, ingredient information, and declared digital source types; implementations may also include resources such as thumbnails.

For the full structure, read What is a C2PA Manifest?.

What C2PA can and cannot do

When values are present in the credential, C2PA can make it possible to inspect the claim generator, signer, recorded actions, ingredients, and declared digital source types. A compatible reader can also perform applicable checks.

If data protected by the credential or the relevant asset binding changes in a way covered by the validation checks, the mismatch can be detected. This is not a universal modification detector: the result depends on what was protected, the asset type, the binding mechanism, and the reader's validation policy.

C2PA is not an AI detector or a general-purpose truth detector. A successful validation indicates that the signed provenance record and its applicable checks passed. It does not prove that every recorded claim is factually true, that the signer is trustworthy, or that edits outside the recorded workflow never happened.

Why a file may have no C2PA data

C2PA is designed as an opt-in provenance system. A file can exist and circulate normally without carrying C2PA credentials.

A file with no readable C2PA data has no C2PA provenance record available to the viewer. That can happen because the producing tool did not attach one, because an editing or export workflow did not preserve it, or because the record moved to a sidecar or remote location that the viewer cannot discover. A screenshot also normally creates a new asset rather than preserving the original credential.

This absence does not establish that the file is authentic, fake, edited, or AI-generated. It may still be completely genuine.

A concrete example

Suppose a photographer crops a camera original in a C2PA-aware editor. The exported image could carry a new manifest that names the software, records the crop action, references the camera original as an ingredient, and signs the new claim. A viewer can then show those declarations as signed provenance evidence and report whether the applicable validation checks succeeded.

The viewer can show what was declared and what still validates. It does not turn those declarations into a guarantee that the scene is real or that every fact about the image is true.

Interactive Tool

Try C2PA Lab

Check a C2PA file directly in your browser and inspect its claims, assertions, ingredients, signer, and validation result without uploading the file.

Check a C2PA file

FAQ

Does a verified C2PA manifest prove a photo is factually true?

No. The credential can establish that a particular signer made or endorsed the recorded claim, and that the protected data remained cryptographically bound to the relevant asset data under the applicable validation checks. It does not independently establish that every claim is factually true. The trustworthiness of the signer is a separate consideration.

Can C2PA detect every edit?

No. It can show edits that a producer recorded and that remain available to the reader. Edits made before signing, outside a supporting workflow, or in a tool that does not record C2PA history are not discoverable by C2PA.

Does no C2PA data mean an image was made by AI?

No. C2PA is opt-in, and many ordinary camera, editing, publishing, and sharing workflows do not attach or preserve C2PA data. Absence only means no readable C2PA provenance record was available to the viewer.

What does C2PA actually record?

C2PA records provenance information that participating tools choose to declare, such as creation or editing actions, ingredients, source information, declared digital source types, and signing information. The exact contents depend on the producer and implementation.

Who created and supports C2PA?

C2PA is maintained by the Coalition for Content Provenance and Authenticity under the Joint Development Foundation. Its ecosystem has drawn participation from technology, media, camera, publishing, and AI organizations, including Adobe, BBC, Google, Intel, Leica, Microsoft, Nikon, OpenAI, Sony, and others.

Explore the C2PA knowledge base

This guide is the starting point for the wider topic cluster: