What are Content Credentials?
Published 10 October 2026
Content Credentials are a signed record stored inside an image file. They say who made the image, with which tools, and what was done to it, such as cropping, filters or generative AI. They're based on an open standard from the C2PA (the Coalition for Content Provenance and Authenticity), whose members include Adobe, Microsoft, Google, the BBC and camera makers.
Some cameras, phones, editors and AI image generators add them. Adobe's apps can, and so does OpenAI's image generator, for example.
What's in them
Each set of Content Credentials, called a manifest, holds:
- Who signed it: the organisation or person whose certificate signed the record.
- The tool: the app, camera or AI service that created the record.
- Actions: what was done, such as "created", "cropped", "color adjusted" or "placed another image". An action can say the image was created with generative AI.
- Ingredients: the files an image was made from, sometimes with thumbnails of them.
- Optional details: an author name, the camera's EXIF data (which can include the location), and the creator's preferences about AI training.
- A signature, and a fingerprint (hash) of the image, which tie the record to this exact file.
An image edited several times can carry several manifests, one for each step. Our inspector shows the latest one.
What they prove, and what they don't
When the signature is valid, Content Credentials show that the record was made by whoever holds the signing certificate, and that the image hasn't changed since. That's useful: a news photo whose credentials show it came from a press agency's camera is more trustworthy.
They don't prove that what the record says is true, and they don't prove an image is real. A missing record proves nothing either: most sites strip metadata, so most images have no credentials at all, real or not.
Our inspector reads and shows what the credentials claim but doesn't check the signatures. To verify them, use the Content Authenticity Initiative's Verify tool at contentcredentials.org.
Do they survive editing and sharing?
Only if every step keeps them. An editor that supports Content Credentials adds a new manifest when you save. Most other apps, and most social networks and messaging apps, drop them along with the rest of the metadata.
Because the record includes a fingerprint of the whole file, any change to the file breaks the match, even removing other metadata. Checkers then report the image as changed after signing.
Should you remove them?
It depends on why you're sharing the image:
- If you made it and want to be able to show that, keep them. Our cleaner warns you before removing them, and you can choose to keep them while removing other metadata (knowing they'll no longer match the file).
- If you're sharing privately, remember they can contain personal details: your name, the camera's data, sometimes the location, and thumbnails of the original images.
For how they relate to AI, see how to check whether an image is AI-generated.