Content Credentials (C2PA): what the signed manifest proves and cannot

This page is part of the deepfake detection hub. It is the provenance half of the checking a face video page, which puts a credential check before any detector score, and it explains why a benchmark site that measures detectors spends a page on something that is not a detector.

01What are Content Credentials?

Content Credentials is the non-technical name the Coalition for Content Provenance and Authenticity (C2PA) gives to a C2PA Manifest: a cryptographically signed structure, stored in or alongside a media file, that records the file's provenance. The C2PA describes itself as developing "an open technical standard for publishers, creators and consumers to establish the origin and edits of digital content", and the Technical Specification's scope section defines the work as "a model for storing and accessing cryptographically verifiable information whose trustworthiness can be assessed based on a defined trust model" (C2PA Technical Specification 2.5).

The specification has moved quickly. Its release notes list version 1.0 in December 2021, 2.0 in January 2024, 2.1 in September 2024, 2.2 in May 2025, 2.3 in December 2025, 2.4 in April 2026 and 2.5 in October 2026. The text is published under a Creative Commons Attribution licence and the standard is royalty free, so it can be implemented by anyone; adoption is, in the specification's own words, "global, opt-in".

02What is inside the manifest?

A manifest is built from three layers. Assertions are the individual statements: the specification says "These statements, called assertions, make up the provenance of a given asset", and they can describe the capture device, the time, the editing actions, the ingredients that went into a composite, and the source type of the content. A claim gathers the assertions and is signed; the result is a claim signature. The specification then states that "These assertions, claims, and the claim signature are all bound together into a verifiable unit called a C2PA Manifest" by a hardware or software component called a claim generator.

Two kinds of binding tie the manifest to the pixels. A hard binding is "One or more cryptographic hashes that uniquely identifies either the entire asset or a portion thereof"; if a single byte of the covered content changes, the hash no longer matches. A soft binding is "A content identifier that is either (a) not statistically unique, such as a fingerprint, or (b) embedded as an invisible watermark", and its job is to find the manifest again if the file has lost it. For generated media the specification is specific: a video produced by a generative model carries an actions assertion that begins with a c2pa.created action whose digital source type is "trainedAlgorithmicMedia", the IPTC term for content made by a trained model.

03What does a valid manifest prove?

It proves three things, and the specification's trust model section is careful about which. First, that the file's covered content is byte for byte what it was when the manifest was signed, because the hard binding still matches. Second, that the assertions have not been altered, because the claim signature still verifies. Third, who signed: "The basis of making trust decisions in C2PA, our trust model, is the identity of the signer associated with the cryptographic signing key". That signer is the software or hardware that did the work, not necessarily the person who held the camera. The Explainer puts it as "The C2PA Manifest is signed with the private key of the software or hardware that performed the operations" (C2PA Explainer).

Whether the signer should be believed is a separate question, answered by a trust list. The C2PA Trust List is "A C2PA-managed list of X.509 certificate trust anchors that issue certificates to hardware & software signers", and the Explainer compares it to the lists a browser or a PDF viewer carries. The technology is the same as web certificates; the Explainer notes that Content Credentials "does not rely on blockchain (or other forms of distributed ledger) technology" and uses standard hashes such as SHA2-256 with X.509 signatures. For a signed edit, only the assertions the signer created are attributed to it: "Only the set of assertions that are listed in the created_assertions field of the Content Credential's Claim are attributed to the signer".

04What can a manifest not prove?

The guiding principles reproduced in the specification say: "C2PA specifications DO NOT provide value judgements about whether a given set of provenance data is 'good' or 'bad'". The Explainer draws the consequence for a reader checking a clip: "provenance information alone cannot tell you whether the digital content is true, accurate or factual". A credential can state that a camera captured a frame at a time and place, and that a named editor then cropped it; it cannot state that the scene in front of the camera was what the caption says it was, and it cannot state anything about a file that never had a credential.

That last point is one the C2PA makes against itself. Asked whether media without Content Credentials should be distrusted, the Explainer answers "Maybe", and adds that "it is not the intention of the specification and guidance to create a two-tier media ecosystem where assets without Content Credentials are universally less trusted". Nor does the standard identify people: "The C2PA specification does not directly address the topic of human or organizational identity"; identity is layered on by other frameworks. The specification's own trust model diagram places the consumer outside the model, "who uses the identity of the signer, along with other trust signals, to decide whether the assertions made about an asset are true". The decision stays with the reader.

05What happens when a platform strips the manifest?

The record can go silent at two points, and the figure above marks both. The first is an edit in software that does not write manifests. The Explainer's example: "if an asset is cropped using a non-Content Credentials aware tool, the provenance data may not be updated to reflect that action". The hard binding then fails, because the pixels changed, and the credential becomes invalid rather than wrong; if the file is later brought into an aware tool, the new signer implicitly vouches for whatever happened in between.

The second is distribution. The specification acknowledges that "An asset can become separated from its C2PA Manifest due to removal or corruption of asset metadata", which is what re-encoding and metadata stripping on upload do. Its answer is the soft binding: a fingerprint or an invisible watermark that lets a validator look the manifest up in a repository, a design the specification calls a Durable Content Credential. Version 2.5 added routes for publishing manifests to a repository and verifying their ingestion. Until a platform either preserves manifests or supports those lookups, a credential that was present at capture may be absent by the time a clip is checked, and absence proves nothing. This is the same gap the in the wild page describes from the detector side: the platform's re-encoding removes the evidence both methods rely on.

06How do Content Credentials relate to deepfake detection?

They answer a different question. A detector infers, from the pixels alone, whether a face was manipulated or generated, and the published benchmarks give the error rates of that inference. A credential records, from the signing software, what was done, and the verification is exact: the hash matches or it does not. The Explainer describes the standard as something that "complements media literacy, fact-checking, and digital forensics approaches such as deep-fake detection" and is "not a cure-all for misinformation".

For a generated face the two meet directly. The generator can sign a c2pa.created action with the trainedAlgorithmicMedia source type into the file, which is a stronger statement than any score a detector could produce on the same pixels; how such faces are made is on the how AI faces are generated page. But the signature travels only as far as the platforms carry it, the detector networks described on the face recognition backbones in detectors page have no access to it, and no count of credentialed versus uncredentialed files has yet been published by a primary source; the deepfake statistics with a primary source page lists what has.