C2PA, also called Content Credentials, is a signed record stored in the file about how it was made or edited. It is not the picture, and it is not the same as a pixel watermark.
When a file has Content Credentials,
people often hear that as a visible badge or a platform label. The useful distinction is narrower: C2PA is a signed provenance manifest stored in the file container. You can share the pixels without noticing it. Software can still read it.
What C2PA typically stores
The Coalition for Content Provenance and Authenticity (C2PA) defines a way to attach claims about origin and edits. Exact fields vary by the tool that wrote the file. Common themes include:
- That a credential exists (the container itself)
- Generator or editor hints when the writer includes them
- A chain of assertions about capture or generation, when present
This is not the same as EXIF GPS, and it is not the same as text burned into the frame.
Where it lives in the file
- JPEG: APP11 marker, often with a JUMBF payload identified as
JP - PNG:
caBXchunk - SVG: XML / metadata using a c2pa namespace
- MP4 / MOV: a top-level
uuidbox with the C2PA UUID - PDF: C2PA or JUMBF markers when they are readable in the file
If you only strip classic EXIF, a C2PA box can remain. If you only re-encode with a generic metadata flag, a uuid box may still survive. Container-aware cleanup matters.
Why this showed up more in 2026
Provenance rules such as the EU AI Act pushed generators to attach machine-readable credentials to some exports. In August 2026, Claude began attaching C2PA to generated image files (JPEG, PNG, SVG). That is a disclosure feature. It is also extra data in the file if you intended to send only the picture.
What C2PA is not
- Not a visible
Made with AI
sticker. Social apps may add their own labels from other signals. - Not SynthID. Pixel-level watermarks stay in the image after a C2PA box is removed.
- Not proof that a file is or is not AI-generated. Plenty of generated files have no C2PA. Plenty of cameras and editors can write credentials too.
Treat a C2PA hit as this container has a provenance manifest,
not as a courtroom verdict.
Inspect first, then decide
If you want to know whether a still, a PDF or an MP4 carries Content Credentials, use a local checker. MetaRemove's Content Credentials checker reads JPEG, PNG, SVG, PDF and MP4/MOV in the browser. The file is not uploaded.
The paid document tool can strip a readable C2PA store from PDF (incremental /AFRelationship updates) and DOCX zip parts. Compressed streams can hide a leftover marker, so a miss is not a forensic guarantee.
If you need the credential for compliance, keep the original. If you need a private copy without that manifest, strip C2PA as metadata. Image cleanup drops the JPEG/PNG/SVG containers. Video PRO drops MP4 uuid boxes, including C2PA, and now labels them in the before/after view.
Related reading
For GPS and camera EXIF on photos, see the photo EXIF / GPS guide. For who reads ordinary video tags, see what video metadata reveals.
