C2PA in Plain English: What Are Content Credentials?

What are Content Credentials?

Signed provenance metadata, Content Credentials are C2PA Manifests carried inside a file: a set of assertions about how the asset was made, referenced by a single claim, and sealed with a claim signature. The Content Authenticity Initiative, which builds the open-source tooling, calls them "the verifiable metadata that the CAI's tools help implementers generate, read, and display, based on the C2PA's technical standards" and describes the result as a nutrition label for digital content.

The signature is the whole difference from the IPTC digital source type, which is one metadata value naming how a file was produced. IPTC supplies a vocabulary term. C2PA supplies a signed container that carries that term alongside the tools, the edits and the source assets behind the file. Any editor rewrites the IPTC value without leaving a trace. Rewriting the pixels under a Content Credential breaks a cryptographic hash, and a validator reports the mismatch. The CAI states the property directly: "Unlike other types of metadata, Content Credentials are cryptographically signed, making them tamper-evident."

Read the IPTC page for the value. Read this one for the container.

What are the parts of a C2PA manifest?

Four terms carry the structure, assertion, claim, claim signature and manifest, and five more describe what happens once a file starts moving. The C2PA specification defines each one. Every definition below is quoted from C2PA Specification version 2.2, published May 2025.

Term	C2PA 2.2 definition, verbatim	In practice
Assertion	"A data structure which represents a statement either made (or 'created') by the signer or simply gathered at claim generation-time, concerning the asset."	One statement: who made it, when, with what, using which action
Claim	"A digitally signed and tamper-evident data structure that references a set of assertions, concerning an asset, and the information necessary to represent the content binding."	The index that gathers the assertions into one signable object
Claim signature	"The digital signature on the claim created using the private key owned by a signer. The claim signature is a part of the C2PA Manifest."	The signer's cryptographic seal over that index
C2PA Manifest	"The set of information about the provenance of an asset based on the combination of one or more assertions (including content bindings), a single claim, and a claim signature."	Assertions plus claim plus signature, as one unit
C2PA Manifest Store	"A collection of C2PA Manifests that can either be embedded into an asset or be external to its asset."	The chain of manifests a file has accumulated
Active manifest	"The last manifest in the list of C2PA Manifests inside of a C2PA Manifest Store which is the one with the set of content bindings that are able to be validated."	The one that describes the file as it stands now
Hard binding	"One or more cryptographic hashes that uniquely identifies either the entire asset or a portion thereof."	The hash that ties the manifest to these exact bytes
Soft binding	"A content identifier that is either (a) not statistically unique, such as a fingerprint, or (b) embedded as an invisible watermark in the identified digital content."	A recovery route when the bytes change
Ingredient	An asset used to build a composed asset, referenced by the manifest of the result	The earlier file that fed this one

The arithmetic that follows from the manifest definition:

1 C2PA Manifest = N assertions + 1 claim + 1 claim signature

Work it through on a real file. A C2PA camera writes a capture assertion, a thumbnail assertion, an actions assertion and a hash assertion into the JPEG. That is 4 assertions, 1 claim referencing all four, 1 claim signature over the claim, so 1 manifest. Open the same file in an editor that supports C2PA, crop it and export. The editor writes a second manifest whose ingredient assertion points back at the first. The manifest store now holds 2 manifests, and the second one is the active manifest, because it is the one whose content bindings match the file you are holding.

How does a validator check a Content Credential?

A validator recomputes the hard binding hash over the asset and compares it to the value the claim recorded, then verifies the claim signature against the signer's certificate. Both checks have to pass. The hash proves the bytes are the ones the signer signed. The signature proves the claim came from that signer and has not been edited since.

That is why a Content Credential answers a narrower question than most people assume. The CAI is explicit that Content Credentials "aren't intended to prescriptively indicate whether a piece of content is 'real'." A valid manifest says this file matches this signed history. It does not rule on whether the photograph is honest.

What a valid Content Credential proves

What validation confirms

• The file matches the bytes the signer signed
• The claim came from that signer and has not been edited

What validation does not confirm

• Whether the photograph is honest
• Whether the content is "real"

Which social networks preserve Content Credentials on upload?

Two companies have published that they read Content Credentials at ingest, Meta and TikTok. No company has published what its pipeline leaves in an uploaded file that someone else downloads.

Network	What the company published	Date	Reads the manifest at upload	Manifest in the downloaded file
Facebook, Instagram, Threads	Reads the "AI generated" information in the C2PA and IPTC technical standards	2024-02-06	Yes, stated	Not documented
TikTok	"Content Credentials attach metadata to content, which we can use to instantly recognize and label AIGC"	2024-05-09	Yes, stated	TikTok said its own credentials "will remain on content when downloaded"
X	No statement located		Not documented	Not documented
LinkedIn	No statement located		Not documented	Not documented
Pinterest	No statement located		Not documented	Not documented
Bluesky	No statement located		Not documented	Not documented
YouTube	No statement located		Not documented	Not documented

Not documented means a company has published nothing on the question, which is different from a company saying no. TikTok's May 2024 post is the one commitment about survival on the list, and it covers credentials TikTok attaches to TikTok content, not a manifest that arrived on an image you uploaded. What TikTok does with an inbound manifest sits under the same reading rule as everything else, and TikTok's own AI-generated label is the visible output of it.

What happens to Content Credentials when a platform re-encodes an image?

Re-encoding rewrites the bytes the claim hashed, so the hard binding no longer matches and the embedded manifest stops validating against the file. Social platforms resize, recompress and convert uploads by default, and any strip of application metadata segments removes the manifest store outright. Andy Parsons of the CAI wrote the constraint plainly in April 2024: "metadata of any kind can be removed deliberately or accidentally."

OpenAI made the same point on 7 May 2024, describing what C2PA does and does not stop: "People can still create deceptive content without this information (or can remove it), but they cannot easily fake or alter this information." OpenAI has added C2PA metadata to images created and edited by DALL-E 3 in ChatGPT and the API since early 2024, and its post named the gap that remains, saying platforms, creators and intermediate handlers "need to facilitate retaining metadata" for any of it to reach a viewer.

So there are two separate questions inside "does it survive". The first is whether the network reads the manifest before it re-encodes anything, which Meta and TikTok both say they do. The second is whether a viewer who saves the image later gets a file that still validates. The second question has no published answer for any network.

What are durable Content Credentials?

Durable Content Credentials combine three signals so provenance survives the loss of the embedded metadata: secure metadata, an invisible watermark, and a content fingerprint. Parsons set out why no one of the three works alone. Metadata is removable. A watermark holds a tiny payload and can be spoofed. Fingerprint retrieval is inexact, so a match is a perceptual check, not proof.

Combined, they give a recovery path. The watermark carries a short identifier plus a pointer to where the manifest is stored. A validator decodes the watermark, fetches the stored Content Credential from that host, uses the fingerprint to confirm the content is a perceptual match and not a spoofed watermark, then verifies the manifest cryptographically. Watermarks are the piece that survives "rebroadcasting efforts like screenshotting, pictures of pictures, or re-recording of media, which effectively remove secure metadata."

Durability is an implementation choice, not something the standard turns on for you. The C2PA spec has carried the facility since the start under soft bindings, and each generator decides whether to use it.

What does this mean for scheduling AI images?

Provenance is written by the tool that makes the file, not by the tool that posts it. An image leaves a generator with whatever manifest that generator signed, and a scheduler moves bytes without re-signing a claim. If you produce assets with an AI social media image generator, the assertions were fixed at generation time.

What stays in your control is your own record. Keep the note of which scheduled posts used generative assets in the social media content calendar you plan from, so a client question about why a badge appeared on one post and not the next has an answer that does not depend on reading a manifest back out of a network. The same rule shapes how you brief writers and designers on AI-generated content: the disclosure you can defend is the one you wrote down, not the one you hope survived an upload.

Frequently asked questions

Is a Content Credential the same thing as a C2PA manifest?

Yes, in the sense that Content Credentials is the consumer-facing name for the C2PA manifest a file carries. The C2PA specification defines the technical object, and the Content Authenticity Initiative popularised the name and builds the open-source tools that generate, read and display it. When a verification tool shows you a Content Credential, it is rendering a C2PA Manifest.

What is the difference between a claim and an assertion?

An assertion is one statement about the asset, such as which software made it or what action was applied. A claim is the single data structure that references the whole set of assertions plus the content binding. C2PA allows many assertions per manifest and exactly one claim, and the claim signature signs the claim, not each assertion individually.

Does a Content Credential prove an image is not AI-generated?

No. It records a signed history, and that history can say a generative model produced the asset. The CAI states that Content Credentials "aren't intended to prescriptively indicate whether a piece of content is 'real'." An image with no Content Credential at all proves nothing either way, because the absence of a manifest is the normal state for most files on the internet.

Can someone edit a Content Credential after it is signed?

Editing it leaves evidence. The claim signature covers the claim, and the hard binding hash covers the asset bytes, so changing either one makes the manifest fail validation. Someone can delete the whole manifest, which is a different problem: deletion is not detectable from the file alone, which is the gap durable Content Credentials try to close with a watermark and a fingerprint.

Do Instagram and Facebook keep Content Credentials on uploaded images?

Meta published in February 2024 that it reads the "AI generated" information in the C2PA and IPTC standards, which describes reading at ingest. Meta has published nothing about whether the manifest is still present in the file a viewer downloads later. Treat that as undocumented, not as a yes or a no.

Which AI image tools write Content Credentials?

OpenAI began adding C2PA metadata to all images created and edited by DALL-E 3 in ChatGPT and the OpenAI API in early 2024, and joined the C2PA Steering Committee in May 2024. The CAI's April 2024 post named Adobe, OpenAI, Meta, Google, Sony, Leica, Microsoft and Truepic as having released or announced in-product support. Check the generator's own documentation before assuming an asset carries a manifest, because support varies by product and by export format.

What is a soft binding in a C2PA manifest?

A soft binding is a content identifier that is not statistically unique, such as a fingerprint, or that is embedded as an invisible watermark, per the C2PA 2.2 definition. It gives a validator a recovery route when the exact bytes have changed and the hard binding hash no longer matches. Durable Content Credentials build on this facility, pairing a watermark with a fingerprint so provenance survives after the embedded metadata is gone.

Can a Content Credential survive a screenshot?

A plain embedded manifest does not, because screenshotting or re-recording produces new bytes that break the hard binding hash. Durable Content Credentials add a watermark specifically to survive what Parsons called rebroadcasting efforts like screenshotting, pictures of pictures, or re-recording of media. A validator that finds no metadata can still decode the watermark and fetch the manifest from wherever it points.

Does TikTok's Content Credentials policy cover images you upload to TikTok?

TikTok's May 2024 statement is a commitment about credentials TikTok itself attaches to TikTok content, not about a manifest that already arrived on an image someone uploaded. What TikTok does with an inbound manifest sits under the same reading rule as everything else on the list, and TikTok has stated only that it reads the manifest at upload, not what survives afterward. TikTok's own AI-generated label is the visible output of that reading step.

What is an ingredient in a C2PA manifest?

An ingredient is an asset used to build a composed asset, referenced by the manifest of the result, in the practical sense the table above gives the term. When a JPEG with its own manifest gets cropped and exported by an editor, the editor's new manifest carries an ingredient assertion pointing back at the original file. The manifest store then holds both manifests, and the newer one is marked active because its content bindings match the file you are holding.