What Is C2PA Metadata?

C2PA is short for the Coalition for Content Provenance and Authenticity, a group that includes Adobe, Microsoft, the BBC, and Intel, among others. They built a standard way to attach a verifiable record of provenance to a media file. Content Credentials is the friendlier brand name stamped on top of that standard, the one you'll actually run into inside apps.

When people say "C2PA metadata," they mean the bundle of structured information a C2PA-aware tool tucks inside an image (or a video, or an audio file): who or what made it, which app produced it, whether AI had a hand in it, and every edit logged since. It's a small dossier that travels with the picture.

What's actually in a C2PA manifest?

The manifest is that record, stored in a JUMBF box inside the file. A typical one holds a few things:

Claim generator: the tool that produced the manifest (e.g., "Adobe Photoshop 25.x", "Bing Image Creator").
Assertions: facts about the asset: when it was created, on what device, by which user, what edits were applied, whether AI generation or training was involved.
Ingredients: references to source assets that fed into this one (a thumbnail of the original photo before edits, for example).
A signature: a cryptographic signature from a trusted issuer that lets a verifier confirm the manifest hasn't been tampered with.

You never actually see any of this in normal use; it's binary data sitting inside the file. The official Content Credentials Verify tool is the easiest way to crack one open and read it.

How is it stored inside an image?

The manifest gets wrapped in a JUMBF box (JPEG Universal Metadata Box Format) and then slotted into the image using whatever container that format provides:

JPEG: inside APP11 marker segments.
PNG: inside a custom caBX chunk.
WebP: inside RIFF chunks.
HEIF / AVIF / MP4: inside ISOBMFF boxes.

None of this touches the pixels. The manifest just rides alongside the image, in its own compartment.

Who's producing C2PA metadata today?

These days you'll run into Content Credentials on images from:

Adobe products (Photoshop, Lightroom, Firefly).
Microsoft Bing Image Creator and Microsoft Designer (AI generations are signed by default).
Some camera firmware (Leica M11-P, Sony Alpha series, Nikon Z9).
OpenAI's image-generation outputs (in some configurations).
Newsroom workflows participating in the C2PA initiative.

The list keeps growing. And honestly, whether a manifest is present doesn't tell you much on its own. What matters is what it says once you open it.

How to check whether an image has C2PA metadata

Two ways to actually check:

Use the official Content Credentials Verify tool. It parses the manifest, checks the signature, and lays out the assertions in plain language. Treat it as the last word.
Or run our C2PA Checker for a quick scan in the browser. It looks for JUMBF markers and known C2PA labels. It won't validate anything, but it's fast, and it never sees your file.

Why someone might want to remove it

Metadata of every flavor (EXIF, IPTC, XMP, and now C2PA) has a long history of leaking more than anyone meant to share. Plenty of ordinary reasons to strip it before a picture goes online:

Avoiding leaking a camera's serial number, GPS location, or originating account.
Producing a clean output for a context that doesn't need provenance (a stock photograph used in a presentation, a screenshot for documentation).
Reducing file size for large batches of uploads.

If any of that sounds like you, our C2PA remover drops the manifest as a side effect of re-encoding to JPG, right in your browser.

When you should not remove it

And the flip side, because it has to be said. Don't strip C2PA metadata in order to:

Misrepresent who created an image, or hide that AI was involved when an audience reasonably expects to know.
Strip credit lines or licensing terms you're not authorized to remove.
Conceal evidence of manipulation in journalism, evidence, or identity-verification contexts.
Evade platform rules that require provenance disclosures for synthetic media.

Our Acceptable Use Policy explains where we draw that line and why.