What Content Credentials (C2PA) prove, and what they don't

You may have seen a small "CR" icon on an image, or heard that a photo "has Content Credentials". Content Credentials are the public name for C2PA, an open standard that lets a camera, an editing app, or an AI tool attach a signed history to a media file.

They are useful. They are also easy to misread. This page explains what a valid record establishes, what it does not, and how to tell the difference.

What a Content Credentials record contains

A C2PA record (called a manifest) is a block of data embedded in the file. It usually includes:

• A claim: statements about the file, such as which tool made it and what actions were taken.
• Actions: entries such as "created", "edited", "converted" or "watermarked", sometimes with a digital source type that says how the content was made (for example captured by a camera, or generated by a trained AI model).
• Ingredients: other files that went into this one, such as the original photo an edit started from. Many records have none.
• A hash binding: a cryptographic fingerprint of the image data, so the record can be matched to this exact file.
• A signature: made with the signer's certificate, so the record can't be changed without detection.

What a valid record can establish

When the signature checks out and the binding matches, you can rely on these points:

1. The record has not been changed since it was signed. A valid signature means nobody edited the claims afterward.
2. The record belongs to this file. If the hash still matches, the image data has not changed since signing. Even a re-save would break the match.
3. Who signed it. The certificate identifies the signer. Checking it against the official trust lists (the C2PA Trust List and the Content Credentials interim list) tells you whether that signer is a recognized organization.
4. What the signer declared. For example, that an AI system generated or processed the image, or that a camera captured it.

Those points are strong, technical evidence. They are the kind of thing you can show someone else and they can check it themselves.

What it does not establish

This is where people overreach.

• It does not prove the scene is true. A camera can sign a photo of a staged event. A valid record describes the file's digital history, not whether what it shows really happened or is what it seems.
• A signature is only as good as the signer. Anyone can create a certificate and sign a record that says "captured by a camera". A valid signature from an unrecognized signer proves the record is intact, not that the claim is trustworthy. PIT does not use an unrecognized signer's camera-capture claim at all, and caps an unrecognized signer's AI claim as "declared".
• Generic actions are not AI evidence. "Created", "converted" and "watermarked" are ordinary steps. Only an explicit AI source type in the record indicates AI involvement.
• It may not say what changed. A record can say an image was AI-edited without saying which part. It also may not name the starting image.
• Missing credentials prove nothing. Most photos have none. Screenshots, many social apps, and many editors remove them. No Content Credentials does not mean fake, and it does not mean genuine.

Example: an AI edit with valid credentials

We asked ChatGPT to shorten the skirt in an iPhone photo and checked the result. The file carried Content Credentials signed by OpenAI's media service, with a valid signature, a valid binding, and a signer on the trust lists. The record declared AI-generated media.

PIT reported AI PROCESSING ESTABLISHED. It also reported the limits: the record does not name the original photo, does not say which region changed, and is the same record OpenAI writes for a fully generated image. So the file proves an AI system produced this version. It does not, by itself, prove an edit of a real photo.

How PIT reads Content Credentials

PIT checks Content Credentials as one part of a wider review, and reports four separate answers:

• Creation: for example, AI-generated, camera capture established, or unknown.
• Alteration / Processing: for example, AI processing established, or no signs found.
• Origin: for example, AI system origin, or origin from Content Credentials.
• Integrity: whether the evidence is cryptographically bound to the file.

Integrity and signer trust are kept apart on purpose. A record can be intact and bound to the file while its signer is unknown; PIT says both things rather than blending them into one score. PIT never gives a real-or-fake verdict.

FAQ

Is a photo with Content Credentials always trustworthy?

No. It tells you about the file's history and who signed it. Judge the signer, and remember the record doesn't prove the scene.

Can Content Credentials be faked?

A record can be signed by anyone, so an unrecognized signer's claims carry little weight. A valid record from a recognized signer can't be altered without breaking the signature.

Why don't most of my photos have them?

Few cameras and phones add them yet, and many apps strip them on upload or re-save.

Does PIT keep my photo?

No. Analysis runs in an encrypted, isolated environment and photos are not stored.