Content Credentials: How C2PA Actually Works

A Content Credential is a signed statement about a file, bound to that file by a hash of its bytes. That single design decision explains both its strength — the statement cannot be silently altered — and its fragility, since any re-encoding changes the bytes and breaks the binding.

The short answer

C2PA is a specification published by the Coalition for Content Provenance and Authenticity, an industry body formed in 2021. Content Credentials is the name used for what a user sees. The technology attaches a cryptographically signed record to a media file describing where it came from and what was done to it.

It is a provenance system, not a detection system. It tells you what a publisher asserted about an asset and proves those assertions have not been altered since signing. It cannot tell you anything about a file that carries no credential, which is most files.

What is in a manifest

The record attached to an asset is called a manifest. Structurally it is a set of assertions, a claim that references them, and a signature over the claim.

An illustrative sketch of what a manifest expresses. This is not the
wire format — it is the shape of the information, so the parts below
have something to refer to.

  manifest
    assertions
      c2pa.actions          [ created, resized, colour-adjusted ]
      creator               "Example News, photo desk"
      capture device        make/model, if the camera signed it
      generative use        whether an AI tool was involved, and how
    ingredients
      parent asset          → hash of ANOTHER manifest
    claim
      references every assertion by hash
      hard binding          → hash of this file's bytes
    claim signature
      signature over the claim
      X.509 certificate chain of the signer

The hard binding, and why it is strict

The claim includes a cryptographic hash over the asset’s data, excluding the region where the manifest itself sits. A validator recomputes that hash and compares. If they differ, the binding fails.

The consequence is that the binding is not robust to any change whatsoever. Not a crop, not a resize, not a re-encode at the same visual quality, not stripping and re-adding metadata. One flipped bit in the pixel data invalidates it. That is not a limitation of the hash choice; it is what a cryptographic hash is for.

There is an important upside to this strictness. A tampered asset does not silently validate. A validator reports that the binding failed, which is a distinguishable state from “no credential” and from “valid credential”. Three states, not two, and any interface presenting this to users has to represent all three or it is misleading.

Ingredients make it a chain

When a C2PA-aware application edits an asset, it does not modify the existing manifest — it could not, because the signature covers it. It writes a new manifest that records the edit and includes the previous manifest as an ingredient, referenced by hash.

Walking that chain backwards is what provenance means here: this published photograph came from this edit of this file, which came from this camera capture. Each link is separately signed, so the chain tells you not only the history but who attested to each step.

The chain also breaks informatively. If an intermediate application was not C2PA-aware, the chain simply stops at that point — the later manifest exists and validates, and it has no parent. The record says “this is where our knowledge starts”, which is more useful than a claim of complete history would be.

What survives, and what does not

The screenshot row is the one that determines how much this technology can achieve on its own. A very large share of how images actually travel — screenshotted, re-shared, recompressed, pasted into messages — destroys a hard binding by construction.

Soft bindings: watermarks and fingerprints

The answer to the screenshot problem is not to weaken the hash. It is to add a second, robust channel that survives transformation and can point back to a manifest stored elsewhere.

• Invisible watermarks. A perturbation embedded in the pixels, designed to survive compression, resizing and screenshotting, carrying an identifier. Robustness is a research question rather than a solved one, and watermarks vary widely in how much they tolerate before the identifier becomes unrecoverable. The evidence is discussed in does AI watermarking work.
• Perceptual fingerprints. A hash computed from visual content rather than bytes, so that a resized or recompressed copy still matches. Requires a lookup service holding the mapping from fingerprint to manifest, and consequently requires somebody to operate that service and be trusted with it.
• What the combination gives. A stripped asset can be matched back to a stored manifest and the original provenance recovered. What it cannot give is the same guarantee: a soft binding says “this looks like the asset that manifest describes”, not “these are exactly those bytes”.

What it proves and what it does not

This is where most reporting on provenance goes wrong, and it is worth stating precisely.

What a valid credential proves. That the assertions in the manifest were signed by the holder of a specific private key, that the certificate for that key chains to an authority your validator trusts, and that the bytes you have are the bytes that were signed. That is a strong statement about integrity and about who is accountable.

What it does not prove. That the assertions are true. A signer can assert whatever they like; the signature makes them accountable for it, not correct. It does not prove a camera was pointed at reality, since a signed capture of a screen is still a signed capture. And it says nothing about the intent of any edit that was faithfully recorded.

And the sentence that matters most: an absent credential proves nothing at all. The overwhelming majority of media carries no credential, because it predates the standard, passed through tools that do not implement it, or was shared in a way that stripped it. Any interface or habit of mind that reads “no credential” as “probably fake” will be wrong far more often than it is right, and will make people distrust authentic material — which is the failure mode that matters, because undermining trust in real evidence is the cheaper attack. The broader argument is in synthetic media, deepfakes and provenance.

Practically: to inspect a credential, use the open-source validation tooling published by the C2PA project rather than trusting a screenshot of a badge in somebody’s interface. Command names and flags change between releases, so check the project’s current documentation, and note that a validator’s answer depends on which trust list it is configured with — two validators can legitimately disagree about the same file.