What are Content Credentials (C2PA), and what do they record?
Written for photographers, designers, journalists and everyday users who want to understand C2PA Content Credentials and control when they stay in a file
Short answer
Content Credentials are an open cryptographic provenance standard developed by the Coalition for Content Provenance and Authenticity (C2PA). When a C2PA-enabled camera, editor (such as Adobe Photoshop or Lightroom) or AI generator (such as OpenAI DALL-E, Adobe Firefly or Google Imagen) exports an image, it embeds a digitally signed JUMBF manifest inside the file header recording the tool used and the edit history. You can check whether any JPEG, PNG or WebP file carries a C2PA manifest, and strip it losslessly if you prefer not to publish your edit history, in our free browser metadata tool.
On this page
When you export an image from Adobe Photoshop, Lightroom, OpenAI ChatGPT / DALL-E, Adobe Firefly or a newer Leica, Sony or Nikon camera, the saved file often carries an extra 50 KB to 300 KB of invisible data called Content Credentials.
Built on the open C2PA (Coalition for Content Provenance and Authenticity) standard, Content Credentials act like a tamper-evident packing slip attached to the image header. Understanding what is inside that manifest, and how easily it can be inspected or removed, helps you decide when to keep it and when to strip it.
How a C2PA manifest sits inside an image file
Unlike traditional EXIF tags (which anyone can edit silently), a C2PA manifest store uses the ISO JUMBF (JPEG Universal Metadata Box Format) container and binds its claims to the image pixels with a cryptographic hash and an X.509 digital signature:
What C2PA records, and where it sits in each image format
| File format | Container segment used by C2PA | Typical byte overhead | What is inside |
|---|---|---|---|
JPEG (.jpg) | One or more APP11 (0xFFEB) JPEG XT box segments (C2PA Spec) | 25 KB to 250 KB (larger if edit-history thumbnails are embedded) | Claim generator, DigitalSourceType, actions list, ingredient hashes and X.509 certificate chain |
PNG (.png) | Ancillary caBX chunk placed before IDAT (W3C PNG Spec) | 25 KB to 250 KB | Same JUMBF manifest structure |
WebP (.webp) | RIFF C2PA / JUMBF chunk after the image data | 25 KB to 250 KB | Same JUMBF manifest structure |
When keeping C2PA helps vs when stripping it makes sense
- When to keep C2PA intact: if you are a photojournalist, documentary photographer or contest entrant shooting with a C2PA-signed camera (Sony, Nikon, Leica, Canon) to prove that a news photograph came from a physical camera sensor rather than an AI generator, keep the original file untouched so verifiers can validate the signature chain.
- When stripping C2PA makes sense:
- Privacy of your editing workflow: Photoshop and Lightroom Content Credentials can list every ingredient layer, timestamp and software build you used, and even minor spot-healing with Generative Fill can attach an AI label to an authentic studio photograph.
- Web performance on small thumbnails: an
APP11manifest chain with embedded ingredient thumbnails can weigh 120 KB inside a 35 KB product thumbnail, meaning 77% of the file download is metadata nobody sees.
How to inspect or strip C2PA Content Credentials in three steps
Our in-browser photo metadata remover parses JPEG APP11, PNG caBX and WebP JUMBF segments directly on your device:
- Open the photo metadata remover in your browser and drop your JPEG, PNG or WebP file onto the box.
- Look at the Content Credentials (C2PA) line in the inspection report to see whether a JUMBF manifest is present alongside standard EXIF and XMP tags.
- Click Save clean copy if you want to splice out the C2PA manifest and all EXIF/GPS headers while leaving the compressed image pixels and ICC colour profile 100% untouched.
To see how C2PA fits into checking whether a picture was made by AI, read our guide on how to check if an image is AI generated.
Questions
What is the difference between EXIF metadata and C2PA Content Credentials?
Standard EXIF tags are plain, unsigned key-value fields (camera model, date, GPS coordinates) that anyone can edit or spoof with software. A C2PA Content Credential is a cryptographically signed JUMBF manifest: if anyone alters a single pixel or assertion after signing, the cryptographic hash check fails.
Where is a C2PA manifest stored inside a JPEG, PNG or WebP file?
According to the C2PA Specification v2.2, in JPEG files the JUMBF manifest store is placed inside one or more APP11 (0xFFEB) marker segments. In PNG files it sits inside a caBX chunk, and in WebP files it sits inside a RIFF JUMBF chunk.
Do C2PA Content Credentials include my name or GPS location?
AI generators like DALL-E and Firefly sign manifests using their company certificate without your personal name. In Photoshop, Lightroom or hardware-signed cameras (Leica, Sony, Nikon), the manifest only includes your name, social links or location assertions if you explicitly opt in to include them.
Can C2PA Content Credentials be removed from an image?
Yes. Because C2PA manifests live inside container metadata segments (such as JPEG APP11) rather than inside the pixels, stripping metadata with our Photo Metadata Remover removes the C2PA manifest completely while leaving the image pixels untouched.
Why do C2PA Content Credentials disappear when I post a photo on social media?
Most social platforms and messaging apps re-encode uploaded images and strip unknown metadata segments (including APP11 and caBX) unless the platform has specifically built a C2PA reader.
Keep reading
How to check if an image is AI generated
Skip the guessing detectors: check a photo’s C2PA Content Credentials, IPTC tags and EXIF headers in your browser first.
GuideRemoving AI watermarks and metadata: what actually comes off
C2PA metadata, visible corner badges and invisible SynthID pixel watermarks work in three different ways. Here is what you can and cannot remove.
GuideHow to remove location from your photos
Turn off Location in the share sheet, stop the Camera recording where you are, and clean files before you email them.
