What Is C2PA?

As editing tools and AI generators became common, the question of where an image came from became harder to answer. C2PA — from the Coalition for Content Provenance and Authenticity — exists to attach that answer to the file.

Instead of describing the image in general, a C2PA manifest records actions: created by this tool, edited with that one, exported at this time.

The provenance record is called a manifest. It is stored in a structured container, usually as a JUMBF box inside the file, and referenced from other metadata such as XMP.

Manifests can be cryptographically signed, so a reader can tell whether the record has been altered. That signature is the reason C2PA is more than a simple metadata field.

Because a tool that handled it attached them. Cameras that sign at capture, editing applications that record an edit history, and AI image generators that disclose their output can all write manifests.

Many images have none at all — the feature has to be supported and enabled.

EXIF and XMP are ordinary metadata: they are plain fields written into the file, and rebuilding the file without them is straightforward.

C2PA is a provenance system. When the manifest is stored as metadata that the encoder can drop, re-encoding removes it. When it is cryptographically bound to the content, or written back by the encoder, it can survive — and a tool should tell you that rather than claim success.

Sometimes. It depends on how the manifest was attached and on the encoder. The practical approach is to try, then check: clean the image, analyse the result, and read the report.

The C2PA remover on this site works that way. It detects Content Credentials during analysis and reports whether they survived the clean, instead of assuming they were removed.

Pixels. Content Credentials are file-level records, so removing them does not alter how the image looks or remove watermarks embedded in the image data.

It also does not determine how a platform treats the image. Disclosure requirements can apply independently — that is a legal and policy question, not a technical one.