Content Credentials (C2PA) explained: how to verify where an image came from

Content Credentials are a signed history attached to an image. They record which app, AI model or camera made it, what was done to it afterwards, and who vouches for that record. They are built on an open standard from the C2PA, and most of the big AI image tools now add them. This guide explains what is inside them, what “trusted” and “valid” mean, who adds them, and how to check an image yourself.

What Content Credentials are

The Coalition for Content Provenance and Authenticity (C2PA) was announced in February 2021 by Adobe, Arm, BBC, Intel, Microsoft and Truepic to fight misleading content with an open provenance standard (C2PA). Its steering committee now includes Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic (C2PA). The C2PA writes the standard; the Content Authenticity Initiative, which Adobe founded in 2019, builds the open-source tools and calls the result Content Credentials (Content Authenticity Initiative).

The record lives inside the image file, signed with a certificate the way a secure website is. If anyone changes the image or the record afterwards, the signature no longer matches.

What a Content Credential records

Here is what we found in a ChatGPT image made in October 2026, read with the uncrop.si AI image checker:

Field	What it said
Signed by	OpenAI OpCo, LLC, with a certificate from a C2PA certificate authority
Written by	OpenAI Media Service API
How it was made	Created with ChatGPT (gpt-image), digital source type “trained algorithmic media”, which means generative AI
Later steps	Converted, and an invisible watermark added to the pixels
When	The signing time, from OpenAI’s time-stamping service

It did not contain the prompt. Other records can list more: a camera model, each edit made in an app such as Photoshop, and the earlier files (“ingredients”) an image was built from.

Trusted, valid and invalid

The C2PA specification grades a record in steps, and every trusted record is also valid (C2PA Technical Specification):

• Valid: the record is intact, the file has not changed since signing, and the signature checks out with a certificate that was valid and not revoked at the time.
• Trusted: valid, and the signer’s certificate also leads back to a trust list. Checkers must include the official C2PA Trust List.
• Invalid: something does not match, usually because the image was changed after it was signed.

The C2PA’s July 2026 deployment guidance puts it simply: valid means intact, while trusted means intact and signed by someone on the C2PA Trust List (C2PA). The official list comes from the C2PA conformance program, which launched in 2025. An older interim list was frozen on 1 January 2026, and content signed under it while its certificate was valid still counts (C2PA). The uncrop.si checker uses both lists.

Who adds Content Credentials

Source	What gets Content Credentials
OpenAI	Images from ChatGPT and the OpenAI API, since early 2024 (OpenAI)
Google	Images from Nano Banana Pro in the Gemini app, Vertex AI and Google Ads, since November 2025 (Google)
Adobe Firefly	Files where every pixel comes from Firefly, such as Text to Image (Adobe)
Microsoft	Images generated or edited with AI in Designer and Copilot (Microsoft), and every Bing Image Creator image (Bing)
Google Pixel 10	Every photo from the Pixel Camera app, and AI-edited images in Google Photos (Google)

Some professional cameras can sign photos as well. Check your camera maker’s documentation for your model.

Where you will see them

• LinkedIn shows a C2PA icon on images and videos that carry Content Credentials. Clicking it shows the app or device, the issuer, the signing date and any AI use the signer declared. LinkedIn notes it cannot yet label all AI content (LinkedIn Help).
• YouTube shows “Captured with a camera” under “How this content was made” when a video comes from a capture tool with built-in Content Credentials and was not edited in a way that breaks them (YouTube Help).
• Gemini reads Content Credentials when you ask whether an image was made with Google AI.
• TikTok says it has labelled more than 3 billion items as AI-generated, using Content Credentials alongside invisible watermarks and its own labelling tools (C2PA).

How to check Content Credentials

1. Use the original file. A screenshot, or a copy downloaded from most social apps, usually has no credentials left.
2. Drop it into the uncrop.si AI image checker. It reads the record on your device, verifies the signature against the C2PA trust lists and tells you whether it is trusted, valid or invalid, along with what it says about AI.
3. For a second opinion, upload it to the Content Authenticity Initiative’s free Verify site, which shows the full history, including earlier versions of the image when they are recorded.

Why credentials disappear

The C2PA’s own guidance warns that screenshots, and exporting through tools that strip metadata, remove embedded Content Credentials, and that a “no Content Credentials found” result can simply mean they were lost along the way (C2PA). That is why companies such as OpenAI and Google pair them with an invisible watermark, which is built to survive those steps. See what SynthID is and how to check it.

Content Credentials, AI labels and SynthID

Question	Content Credentials	IPTC AI label	SynthID
Where it lives	A signed record in the file	A plain metadata field in the file	An invisible pattern in the pixels
Can it be checked by anyone?	Yes, with free tools	Yes	No, only by Google and OpenAI
Proves who made it?	Yes, when trusted	No, anyone can write it	That a participating company’s AI made it
Survives a screenshot?	No	No	Built to survive many edits

No single mark covers every case, so check all three. The full routine, including what to do when the file says nothing, is in how to tell if an image is AI-generated.