C2PA and Content Provenance, Explained

C2PA is an open technical standard for cryptographically signed provenance metadata, which records where a file came from and how it was edited. You may know it by its consumer name, Content Credentials.

The idea is simple. A file carries a small, signed record of its own history. A verifier can read that record and confirm it has not been tampered with.

This guide explains what C2PA is, how it works in plain terms, how it differs from a statistical text watermark, which files carry it, why Claude now attaches it, and the one limitation that decides how much you can trust it.

What is C2PA?

C2PA stands for the Coalition for Content Provenance and Authenticity, an open standard for attaching cryptographically signed provenance metadata to a media file. That metadata records the file's origin and edit history, so a viewer can see where it came from and what changed.

The standard is published by C2PA, a group hosted under the Joint Development Foundation. It was co-founded by Adobe, Microsoft, the BBC, Intel, Arm, and Truepic, and its steering committee has since grown to include Google, Sony, and others.

The consumer-facing name for this metadata is Content Credentials. When you hear a camera maker or an AI vendor say a file has Content Credentials, they mean it carries C2PA data.

The point of the standard is provenance, not a verdict. C2PA does not tell you whether content is true or good. It tells you who or what created or touched the file, in a record that is hard to forge without breaking the signature.

• Provenance: where the file came from and who made it.
• Edit history: what tools or steps changed it along the way.
• Signed: the record is cryptographically sealed, so tampering is detectable.
• Open: any tool can implement it, and any verifier can read it.

How does C2PA work?

C2PA works by attaching a signed manifest to the file that records who or what created or edited it. A verifier reads the manifest, checks the digital signature, and confirms the record has not been altered.

The manifest is a small block of structured data bound to the file's contents. It can list the originating device or software, the time, and each edit step, and it references the actual pixels or bytes so a change to the file breaks the seal.

The signature is the trust anchor. Whoever creates or edits the file signs the manifest with a cryptographic key. A verifier uses the matching public certificate to confirm the signer's identity and that nothing in the manifest was changed after signing.

So the guarantee is narrow but strong. If the signature checks out, you can trust the recorded history. If someone edits the file and re-saves it without re-signing, the credential no longer validates, which is itself a signal.

• A creator or tool writes a manifest describing origin and edits.
• The manifest is cryptographically signed and bound to the file bytes.
• A verifier reads the manifest and checks the signature.
• Any change after signing breaks validation, which is detectable.

C2PA vs Content Credentials vs the text watermark

Content Credentials is the consumer brand of C2PA, and the two describe the same signed file metadata. The name is promoted by the Content Authenticity Initiative, so people meet the friendly term long before they meet the standard behind it.

The Content Authenticity Initiative is a community founded by Adobe that pushes adoption of Content Credentials across cameras, editing software, and platforms. C2PA writes the technical spec; the initiative drives it into products.

A statistical text watermark is a different mechanism entirely. It is not attached metadata. Instead it is a faint pattern woven into the words themselves, created by biasing which tokens a model picks as it writes. We cover it in depth in our guide to AI watermarking and in Claude's watermark, explained.

The practical split is this. C2PA marks files and lives in metadata that can be stripped. A text watermark marks generated prose and rides inside the text, so it survives copy and paste. They solve different halves of the same provenance problem.

• C2PA / Content Credentials: signed metadata on a file, same thing, two names.
• Content Authenticity Initiative: the group promoting Content Credentials adoption.
• Statistical text watermark: a pattern inside generated text, not metadata.
• Different targets: one marks files, the other marks words.

What files carry C2PA, and Claude's role

C2PA is designed for media files, and Claude now attaches signed C2PA metadata to supported files it generates or processes, specifically .png, .jpg, and .svg. This is the file half of Anthropic's broader content-marking approach.

Claude is one signer among many. Adobe products can write and read Content Credentials, and camera makers like Leica, Nikon, and Sony have shipped bodies that sign photos at capture. The whole value of an open standard is that many tools speak it.

Anthropic applies this at the model level with no product opt-out, alongside an invisible text watermark on generated prose. The C2PA metadata covers images; the text watermark covers words. Together they mark both kinds of output.

For your own work, the takeaway is that a growing share of images now arrive with a provenance record. When your pipeline preserves that record, downstream viewers can trace an asset back to its source.

• Claude: signs supported .png, .jpg, and .svg files it creates or edits.
• Adobe: Photoshop and other tools read and write Content Credentials.
• Cameras: some Leica, Nikon, and Sony bodies sign photos at capture.
• Any C2PA tool: the standard is open, so implementations interoperate.

The big limitation: C2PA metadata is strippable

The honest trade-off is that C2PA metadata is trivially strippable. Re-saving a file, taking a screenshot, converting the format, or uploading to a platform that discards metadata all remove the credential.

That matters because absence proves nothing. A file with no Content Credentials is not proof that content is human-made or untouched by AI. It may simply have passed through a step that dropped the metadata.

This is the structural weakness of a metadata approach. The record sits beside the content, not inside it, so anything that rewrites the file can leave the record behind. No signature is broken; the credential is just gone.

It is the opposite of the text watermark, which rides inside the words and survives copy and paste. That is why Anthropic pairs the two. The file gets a rich, signed history that is easy to strip, and the text gets a faint signal that is harder to remove.

• Re-saving a file can drop the credential.
• Screenshotting produces a new image with no metadata.
• Converting formats often discards the manifest.
• Uploading to platforms that strip metadata removes it on the way in.

Why C2PA matters for businesses

C2PA matters for businesses because provenance builds trust in the assets you publish, and trust is now a competitive edge. Signed history helps in marketing, journalism, and any setting where a doctored image would cause real harm.

For brand and marketing teams, Content Credentials let you show that a hero image came from your studio and your edits, not a scraper or a deepfake. For journalism and legal evidence, a verifiable chain of custody raises the bar on what counts as authentic.

Across the content-automation routines we run on our own portfolio, the pattern we see is that provenance metadata rarely survives a real publishing pipeline untouched. Image optimizers, CDNs, and format converters strip it silently, so preserving Content Credentials takes deliberate configuration, not luck.

The practical first step is to audit where your files lose their metadata. Map the path from creation to publish, find the step that strips it, and choose tools that preserve the credential end to end. If that sounds like your workflow, our AI workflow audit is built for exactly this.

• Brand assets: prove a marketing image is yours, not a fake.
• Journalism: support a verifiable chain of custody for photos.
• Legal and compliance: signed origin data strengthens evidence.
• Pipeline hygiene: find and fix the steps that strip your metadata.

How to check a file's Content Credentials

To check a file's Content Credentials, upload it to the official Content Credentials Verify tool at contentcredentials.org/verify, which reads any C2PA manifest and shows the signed origin and edit history. Some editing apps also display the credential inline.

Read the result carefully. A valid credential tells you who signed the file and what edits are recorded. It does not, by itself, tell you the content is true, only that the recorded history has not been tampered with.

Remember the strippable caveat. If the file has no credential, the metadata may already have been removed by a re-save, a screenshot, or a platform upload, so you learn nothing about its origin from the absence alone.

For the text side of provenance, checking is harder and less mature. Public tooling to read Anthropic's text watermark is still forthcoming, and generic detectors do not read it, as we explain in our AI watermark detector guide. For the regulation driving all of this, see EU AI Act Article 50.

• Use the official Verify tool at contentcredentials.org/verify to read a manifest.
• Read the history, not a verdict; it shows origin, not truth.
• No credential is inconclusive: the metadata may already be stripped.
• Text is different: no public reader for the Claude text watermark yet.

C2PA file metadata vs a statistical text watermark

C2PA file metadata and a statistical text watermark do different jobs, and the table below lines up the differences that matter for a real workflow. Use it to decide which signal you can rely on in a given situation.

The short version: file metadata carries a rich, signed history but is easy to strip, while the text watermark carries a faint signal that survives copy and paste but tells you far less. Neither one alone answers every question.