isGenAI.com

Glossary

C2PA: the standard behind Content Credentials

C2PA (Coalition for Content Provenance and Authenticity) is an open technical standard for attaching a cryptographically signed manifest to a media file that records who signed it and which actions, including AI generation, produced it.

Definitions and isGenAI behaviour as of October 2026. Updated .

Validate a manifest in the C2PA checkerFrequently asked questions
Controlled example PNG file that carries this record: Content Credentials found

test-signed.pngPNG file · controlled example

  1. Signature + IHDR
  2. iTXt XML:com.adobe.xmp
  3. tEXt parameters
  4. tEXt prompt / workflow
  5. tEXt invokeai_metadata
  6. eXIf
  7. caBX C2PA manifestrecord
  8. IDAT pixels
  9. IEND

Content Credentials found

A signed manifest describes how the file was made.

Signer, recording tool, actions and the signature check result are reported separately, so you can weigh each one.

Open the Content Credentials checker →
Content Credentials found: where this record sits inside a PNG file and what the isGenAI report says about it. The picture is a code-drawn controlled example that carries this record; download it and check it yourself.

Quick answer

What is C2PA, and how do I check it?

C2PA is the open standard behind Content Credentials: a signed manifest that records who made a statement about a file and which actions, including AI generation, produced it. isGenAI (isgenai.com) offers a free C2PA checker that validates the manifest and reports signature validity and signer trust as separate results.

  • C2PA stands for Coalition for Content Provenance and Authenticity.
  • Manifests are stored in a JUMBF box inside JPEG, PNG, WebP, AVIF, HEIF, TIFF, MP4, PDF and other containers.
  • Re-encoding, screenshots and most social media uploads strip the manifest.
  • A missing manifest is not evidence of a camera or of a human author.

Last updated by . Methodology and limits

What the standard defines

A C2PA manifest bundles assertions (such as actions taken, the generating tool and the IPTC digital source type), a claim that lists those assertions with hashes of the file content, and a signature over the claim made with an X.509 certificate. Manifests are stored in a JUMBF box inside JPEG, PNG, WebP, HEIF, AVIF, TIFF, MP4, MOV, PDF and other containers. A validator checks that the signature is intact, that the content hashes still match and whether the signer’s certificate chains to a trust list.

C2PA does not say whether content is true or false. It says who signed a statement about the file and whether the file has changed since.

How isGenAI uses C2PA

The AI image detector and the C2PA checker validate the manifest locally and report three separate facts: cryptographic validation (is the signature intact and the content unchanged), trust validation (is the signer on the trust list) and the recorded actions and digital source types. A valid, trusted manifest with trainedAlgorithmicMedia is reported as strong, direct evidence that AI was used; a valid signature from an untrusted signer is reported as moderate; a camera credential from a trusted signer is reported as evidence of capture.

A broken hash is reported as tampered or edited after signing. A missing manifest is reported as nothing, never as proof of a camera.

Limits worth knowing

Most social platforms and messaging apps strip the manifest on upload, and a screenshot never has one. The C2PA specification therefore also describes soft bindings, such as watermarks and fingerprints, that can reconnect a stripped file to its manifest. Researchers continue to probe the specification’s edge cases, so the trust list and validator version matter.

How to use this term when checking a file

  1. Upload the original file to the AI image detector or the tool named on the page.
  2. Find the finding that uses this term under “How we checked” and read the source field it names.
  3. Weigh it by kind: a signed record, a declared field, a saved prompt and a matching copy are different strengths of evidence.
  4. Remember that absence of a record is not evidence of a human author.

Validate a manifest in the C2PA checker

Frequently asked questions

What does C2PA stand for?

Coalition for Content Provenance and Authenticity, the body that publishes the Content Credentials specification.

Does a valid C2PA signature prove an image is AI-generated?

It proves that the signer recorded the actions in the manifest and the file is unchanged. If those actions include AI generation with a trained-algorithmic-media source type, isGenAI reports strong direct evidence.

Which generators write C2PA?

OpenAI, Adobe Firefly, Black Forest Labs’ API and newer Google models document it; see the generator pages for each vendor’s statement.

Can C2PA be removed?

Yes. Any re-encode, screenshot or metadata stripper removes it. Its absence is not evidence of anything.

Sources

Definitions follow the published standards linked above; the isGenAI behaviour described is the deployed checker as of October 2026.