What Are Content Credentials (C2PA)? 2026 Guide

What are Content Credentials?

Content Credentials are a tamper-evident provenance record attached to a media file. Think of them as a verifiable birth certificate for an image or video: they record the file's origin, the tools involved in creating or editing it, and whether any AI was used in the process. Anyone can read and verify these credentials without installing special software or creating an account.

They are built on the C2PA standard (Coalition for Content Provenance and Authenticity), an open technical specification developed by a coalition that includes Adobe, Microsoft, Google, Meta, OpenAI, Sony, BBC, and Amazon, among 6,000+ members. The C2PA specification is maintained as an open standard, which means any organisation can implement it without paying licensing fees.

The official brand name for consumer-facing implementations is "Content Credentials," maintained by the Content Authenticity Initiative (CAI), which was founded by Adobe. The technical standard underneath is C2PA. Both terms refer to the same underlying system.

Concretely, a C2PA manifest contains:

• The issuer: the organisation or individual who signed the credentials (for example, Adobe, OpenAI, or a specific camera manufacturer).
• The creation date and timestamp.
• The tools used: for example, Adobe Photoshop 2026, ChatGPT, or a Sony camera model.
• AI involvement: whether any generative AI model was used to create or edit the content, and if so, which model.
• The edit history: a log of actions taken on the file, such as crop, resize, or AI-generated fill.
• A cryptographic hash: a fingerprint of the file at the time the credentials were signed, which makes tampering detectable.

How C2PA works technically

When a C2PA-enabled application (for example, Adobe Photoshop or a Sony camera with C2PA support) exports a file, it creates a manifest: a structured data record containing all the provenance information listed above. The manifest is then cryptographically signed using a certificate issued by the C2PA trust infrastructure. The signing step is what makes the credentials "tamper-evident."

The manifest is embedded in the file's metadata layer alongside (but separate from) the pixel data. For JPEG files, it goes into a specific EXIF/XMP slot. For other formats like PNG, MP4, or WebP, the manifest uses format-specific container slots.

When someone checks the credentials using a verification tool, the tool does two things:

• It checks the cryptographic signature against the C2PA trust list to verify that the issuer is a legitimate, recognized organisation.
• It recomputes the file's hash and compares it to the hash stored in the manifest. If the pixel data was altered after signing (for example, by editing in an application that does not preserve credentials), the hash will not match, indicating tampering.

An important nuance: credentials can be "hard binding" (any pixel change breaks the hash, showing the edit) or "soft binding" (allowing certain transformations like JPEG re-compression while flagging them). Most implementations in 2026 use soft binding to accommodate normal distribution workflows.

A critical point to understand: if the credentials are stripped from the file (for example, by taking a screenshot or re-exporting without preservation), the absence of credentials does not prove the image is manipulated. It simply means there is no verifiable provenance. This is an acknowledged limitation of the system.

C2PA vs SynthID vs EXIF: comparison table

Three different technologies are often confused when people discuss image provenance and AI disclosure. Here is a clear comparison of what each one actually does.

The practical takeaway: C2PA is the most comprehensive and verifiable of the three, but it requires the issuing application to implement it. SynthID survives more aggressive transformations but is specific to Google AI outputs. EXIF is universal but carries no cryptographic guarantees. They are complementary rather than competing technologies.

Who is using C2PA in 2026

2026 is the year C2PA moved from a coalition project to a genuine infrastructure layer for the web. Here is what has actually shipped:

OpenAI: all ChatGPT and API images

Since May 2026, OpenAI applies C2PA Content Credentials to every image generated by ChatGPT (including the free tier) and through the DALL-E API. The credentials record that the image was AI-generated by OpenAI and include a timestamp. OpenAI also applies Google DeepMind's SynthID invisible watermark simultaneously, so generated images carry both provenance signals.

This is a meaningful development because ChatGPT is the largest consumer AI image generator by user count. A significant share of all AI images produced daily now carry verifiable C2PA credentials.

TikTok: 1.3 billion AI videos labeled

TikTok has used C2PA to label over 1.3 billion AI-generated or AI-edited videos on the platform. This makes TikTok the largest single deployment of C2PA by volume as of mid-2026. The labels appear as a visible indicator in the TikTok interface and are backed by C2PA credentials in the underlying file.

Google Search and Chrome: native verification coming

At Google I/O 2026, Google announced that C2PA verification and SynthID detection are coming natively to Google Search and the Chrome browser. This means users will eventually be able to see an image's provenance record directly in search results and while browsing, without needing any third-party tool. The rollout timeline was not specified, but the announcement confirmed that Google is treating C2PA as infrastructure rather than an optional feature.

Adobe, Sony, Leica, and Nikon: the camera and editing layer

Adobe embeds Content Credentials in all exports from Photoshop, Lightroom, and Firefly (Adobe's generative AI). Sony, Leica, and Nikon have shipped cameras that sign every RAW file at capture with C2PA credentials, providing a chain of custody from the physical moment of capture through any editing workflow. This is particularly relevant for photojournalism, where authenticity from the moment of capture is critical.

The 6,000 member coalition

The C2PA coalition, which manages the standard, has grown to over 6,000 members across media, technology, camera manufacturers, and news organisations. Members include BBC, Reuters, the Associated Press, Microsoft, Amazon, Meta, and many others. The breadth of the coalition is significant: it means C2PA is not a proprietary system controlled by any single company, and it has genuine industry-wide adoption across sectors that previously had no common provenance standard.

How to view Content Credentials today

You do not need to install any software to check whether an image has Content Credentials. The primary verification method is the official tool maintained by the Content Authenticity Initiative.

Method 1: contentcredentials.org/verify

Go to contentcredentials.org/verify. Upload an image file or paste a direct image URL. The tool reads the C2PA manifest and displays the full provenance record: the issuer, creation date, AI involvement, tools used, and edit history. If no credentials are found, the image either has none or they were stripped during export or social media processing.

This tool works in any modern browser on desktop and mobile. No account is required. The image is not stored by the tool.

Method 2: The Cr icon in Adobe applications

In Adobe Photoshop, Lightroom, and Bridge, images with valid Content Credentials display a small "Cr" icon in the interface. Clicking the icon opens the full credentials panel showing the complete provenance record. This is the most seamless workflow for professional photographers and photo editors who already work in the Adobe ecosystem.

Method 3: CAI browser extension

The Content Authenticity Initiative provides a browser extension for Chrome and Firefox that shows the credentials icon on images while you browse the web. When you hover over or click an image, the extension checks for a C2PA manifest and displays the provenance information inline. This is the closest thing to a real-time verification experience currently available.

Coming soon: Google Search and Chrome native

As announced at Google I/O 2026, native C2PA verification is coming to Google Search and Chrome. When this ships, you will be able to see provenance information directly in search results without any extension or third-party tool. This will be the most significant expansion of C2PA accessibility to date, given that Google Search handles billions of image impressions per day.

Why it matters for creators, marketers, and journalists

Content Credentials are not just a technical curiosity. They have real, practical implications for anyone who creates, distributes, or publishes visual media.

For photographers and creators: protecting your work

If you shoot with a Leica, Sony Alpha, or recent Nikon camera model that supports C2PA, every image you capture is signed at the sensor level. This creates an unbroken chain of custody from the moment of capture. If someone later claims your photograph is AI-generated, you have a cryptographic record proving it was taken by a physical camera at a specific time and location.

For photographers who also use AI editing tools, Adobe Photoshop's credentials system records which edits were made by AI (such as Generative Fill) and which were manual. This gives clients and editors a transparent record of the post-processing workflow.

For marketers: building trust in AI-generated campaigns

As brands increasingly use AI-generated images in advertising and social media, transparency about AI involvement is becoming both a legal requirement (in the EU) and a brand trust consideration. Attaching Content Credentials to AI-generated campaign assets provides a verifiable record of disclosure, which is more robust than simply adding a caption or label.

A visible "Made with AI" label combined with C2PA credentials gives you both human-readable and machine-readable disclosure. This two-layer approach is the most complete implementation of AI transparency currently available.

For journalists and news organisations

BBC, Reuters, and the Associated Press are all C2PA coalition members. The news industry's interest in C2PA is straightforward: verifying that a photograph has not been manipulated is a core editorial concern, and C2PA provides a technical mechanism for doing this at scale. When a camera-captured image carries credentials from a trusted issuer (a specific photojournalist, a news organisation), editors can verify the image's authenticity before publication.

This does not eliminate the need for editorial judgment, but it adds a verifiable technical layer to the existing editorial workflow.

For everyday users: a new layer of media literacy

As Content Credentials become more widespread (particularly with Google Search's upcoming native support), checking an image's provenance will become as routine as checking a website's HTTPS certificate. When you see an image on the web, you will be able to verify in a few clicks whether it is a photograph taken by a specific person on a specific day, an AI-generated image from a known generator, or an image with no verifiable provenance at all.

The third category, no verifiable provenance, will become the most important signal. The absence of credentials is not proof of manipulation, but it is a prompt for additional scrutiny.

The EU AI Act connection

The EU AI Act's Article 50 requires that AI-generated content be labeled in a way that makes clear to people they are seeing AI output. This requirement applies to any provider deploying AI systems that generate text, images, audio, or video for users in the EU. The deadline for compliance on transparency obligations was August 2026.

C2PA Content Credentials are not specifically mentioned in the EU AI Act text, but they are directly relevant to fulfilling it. The Act requires that the labeling be "machine-readable" as well as human-readable. C2PA provides the machine-readable layer; a visible label provides the human-readable layer. Using both together is the most complete approach to compliance.

For a detailed breakdown of what Article 50 requires and how to implement visible AI disclosure labels, see our guide: EU AI Act: How to Label AI-Generated Content. For the practical tool to add visible labels to your images and videos, see SammaPix AI Label.

Practical tools you can use now

While a full C2PA signing workflow requires integration with a C2PA-enabled application (such as Adobe Photoshop or an API implementation), there are several things you can do today without any special software.

Verify credentials on any image

Use contentcredentials.org/verify to check whether an image carries C2PA credentials. This works on any image you have saved locally or can access via URL.

Add a visible AI disclosure label (human-readable)

The SammaPix AI Label tool lets you add a visible "Made with AI" or custom disclosure label to any image. This runs entirely in your browser, with no upload. It is the human-readable disclosure layer that complements C2PA's machine-readable credentials. For videos, the AI Label for Videos tool does the same for MP4 and WebM files.

Inspect and manage basic EXIF metadata

The SammaPix EXIF Viewer shows all the basic metadata in your image files (camera model, GPS, timestamps, software) and lets you strip it with one click. This is a different layer from C2PA credentials, but it is directly relevant to understanding what information is embedded in your files. Free, no upload, browser-based.