Every conversation about photo authenticity arrives at the same dead end. Metadata can be edited. Visual forensics are increasingly unreliable against generative tools. And "trust me, I took it" is not a mechanism.
Content Credentials are the current serious answer. They are the user-facing name for the technical standard published by the Coalition for Content Provenance and Authenticity — C2PA — and the approach is different in kind from anything EXIF does. Instead of describing a file, a Content Credential signs it, cryptographically, and ties that signature to the pixels themselves. This guide explains the actual machinery, in the standard's own vocabulary, and is deliberately specific about what the guarantee covers.
What C2PA is, and who is behind it
C2PA is an open technical standard for establishing the origin and edit history of digital content. The coalition is established as a Joint Development Foundation Projects, LLC, and its published steering committee comprises Adobe, Amazon, the BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, and Truepic — a mix of platform operators, device makers, publishers, and AI model developers. The broader membership is considerably larger.
A related organization is referenced constantly alongside it: the Content Authenticity Initiative, or CAI, the adoption arm that maintains open-source implementation tooling and the public Verify inspection tool. C2PA writes the specification; the CAI drives its use. The two are frequently conflated.
The specification is in its 2.x series and is being taken through international standardization as ISO/DIS 22144, "Authenticity of information — Content credentials." A standard with an ISO number is one that procurement departments, broadcasters, and regulators can reference in policy.
The core structure: assertions, claims, signatures, manifests
The specification's data model is small and worth learning precisely, because the terms are used loosely everywhere else.
An assertion is the atomic unit — a data structure representing a statement made by the signer or gathered at claim-generation time, concerning the asset. Assertions are individual facts: the capture device model, the creation timestamp, a thumbnail, editing actions performed, the identity of the creator, whether generative AI was involved.
A claim gathers a set of assertions together. The specification defines it as a digitally signed and tamper-evident data structure that references a set of assertions concerning an asset. The claim is what actually gets signed — it references the assertions rather than duplicating them, and each reference includes a cryptographic hash of the assertion it points to.
The claim signature is the digital signature over that claim, created with the private key held by the signer. This is where trust enters the system: the signature is made with an X.509 certificate, and validators check that certificate against the C2PA trust list.
Together, the assertions, the claim, and the claim signature form a C2PA Manifest — the tamper-evident container holding a file's provenance information. The component that assembles it — camera firmware, a phone's camera app, editing software — is the claim generator.
Because files get edited and reused, a single asset can carry several manifests. These live in a manifest store, embedded in the file or held externally. Manifests are ordered, and the most recent is the active manifest.
The hard binding: why this is not just signed metadata
The mechanism that separates C2PA from everything before it is the hard binding: one or more cryptographic hashes that uniquely identify the asset, either the whole file or a defined portion of it. That hash is carried as an assertion, and the assertion is covered by the signed claim. So the signature does not merely vouch for a block of metadata sitting near the image. It vouches for a hash of the image data itself.
The consequence is direct: change a single pixel, and the recomputed hash no longer matches the one in the signed claim. A validator detects the mismatch immediately. There is no way to alter the image and leave the credential intact, because the credential is a statement about those exact bytes.
The specification also defines soft bindings — a content identifier that is not statistically unique, such as a perceptual fingerprint or an invisible watermark. Soft bindings survive re-encoding and resizing, which hard bindings cannot, and are used to match a derived copy back to a manifest separated from it. They are a recovery mechanism, not a tamper-detection mechanism, and carry weaker guarantees.
How tamper-evidence actually behaves
A common misconception is that editing a Content Credentialed photo "destroys" it. What happens is more nuanced, and the distinction is the whole point of the design.
Edited by a C2PA-aware tool: the editor validates the incoming manifest, applies the edit, records what it did as action assertions, and signs a new claim — producing a new active manifest that references the prior one as an ingredient. The chain extends. A viewer sees both the original capture and the fact that cropping and exposure adjustment were applied afterward.
Edited by a tool that knows nothing about C2PA: the pixels change, the hard binding no longer matches, and the manifest — if it survives at all — fails validation. The file is not silently corrupted; it is loudly flagged. Often the manifest is stripped entirely by the re-save, in which case the file simply has no credential, like any ordinary photo.
Manifest removed deliberately: entirely possible, and trivial. What is not possible is stripping it and having the file still appear credentialed, or altering the image while keeping a valid credential. C2PA does not prevent an image from being anonymous; it prevents an image from lying about being verified.
Validity over time is handled with trusted timestamps. Combined with a timestamp, a claim signature can be validated indefinitely — a verifier can determine that the claim was signed while the signing credential was valid, even years later when that certificate has expired.
What Content Credentials do not prove
This is the section that matters most, and it is the one most often skipped.
A credential attests to capture and edit history. It does not attest that the scene is truthful. A camera with impeccable C2PA support, pointed at a staged scene, a printed photograph, or a screen displaying a synthetic image, produces a perfectly valid Content Credential. The signature is honest — this device really did capture these photons at this time — and the content is still a lie. No provenance system closes that gap.
A valid signature is not an endorsement. It establishes that a specific signer, holding a specific certificate, made a specific set of statements. Whether that signer is trustworthy is a separate judgment — which is why the trust list and the conformance program exist rather than the standard accepting any signature.
Implementations can be broken, and have been. In 2025 Nikon shipped C2PA support on the Z6III via firmware, then suspended the service after researchers demonstrated that the camera's multiple-exposure mode could fold an externally supplied image into a file the system would still sign and validate. Nikon subsequently revoked the certificates it had issued. A useful, unflattering case study: the cryptography held perfectly, and the capture pipeline feeding it did not. Reporting at the time also noted a practical wrinkle — revocation only helps if validators check for it, and default behavior in validation tooling does not always do so.
Absence of a credential means nothing. The overwhelming majority of photographs in the world have no Content Credential, and never will. C2PA gives good actors a way to demonstrate provenance. It does not turn unlabeled content into suspicious content.
Where support stands
Adoption is real, uneven, and moving.
Cameras. Leica's M11-P, announced in October 2023, was the first production camera to ship Content Credentials. Sony, Canon, and Nikon have since brought support to selected professional bodies, generally through firmware updates rather than new hardware. Support is body-by-body and firmware-dependent — check the specific model rather than assuming a brand.
Phones. Google announced C2PA Content Credentials for the Pixel 10 series in September 2025, with the Pixel Camera app applying credentials to photos by default and achieving Assurance Level 2 under the C2PA conformance program — the highest level currently defined — backed by the device's hardware security. Samsung has shipped Content Credentials on flagship Galaxy devices, though its implementation has been scoped more narrowly toward AI-generated and AI-edited images rather than every capture. The distinction matters: "the phone supports C2PA" and "the phone signs every photo you take" are different claims.
Software and conformance. Adobe applications including Photoshop, Lightroom, and Firefly write Content Credentials, and several major AI image generators attach credentials marking output as synthetic. The C2PA conformance program certifies that a product produces and validates credentials correctly and meets a set of security requirements; it currently defines two assurance levels, recorded in the product's claim-signing certificate — the closest thing to a meaningful quality signal about an implementation.
How a verifier checks a credential
Validation is mechanical, and you can do it yourself: the CAI operates a public Verify tool at verify.contentauthenticity.org, where you upload a file and see its manifest chain.
What the validator does, in order: locate the manifest store and identify the active manifest; verify the claim signature against the signer's certificate and confirm that certificate chains to a trusted root on the C2PA trust list; check any timestamp; recompute the hashes of every referenced assertion and confirm they match the claim; then recompute the hard binding over the asset data. If every step passes, the manifest is valid. It then walks the ingredient chain and repeats for each prior manifest.
The output is not a verdict on truth. It is a precise statement of who signed what, when, and whether the bytes still match. It pairs directly with knowing what EXIF metadata can and cannot establish, since the two are constantly confused for each other.
Why this is the right layer to solve the problem
Detection — examining an image after the fact and deciding whether it was manipulated — is a losing race against improving generative models. Provenance inverts the problem: rather than asking an analyst to prove a photo is fake, it lets a capture device prove, at the moment of capture, that a specific file existed in a specific form at a specific time. That claim gets stronger over time rather than weaker, because cryptography does not degrade the way visual forensics do.
C2PA is not a truth machine, and anyone selling it as one is overstating it. It is an openly specified, independently verifiable answer to a narrower and more tractable question: where did this file come from, and has it changed since? For most documentation that has to survive scrutiny, that question decides the outcome. It is the standard EtchImage is built on, and the reason we would rather explain it in full than describe it vaguely.