C2PA Content Credentials are a signed record, stored inside an image file, that says who or what created it and how it was edited, including whether generative AI was involved. Because the record is metadata (in a JPEG it sits in APP11 segments as JUMBF boxes), any tool that strips metadata removes it, including ours. Invisible watermarks such as Google's SynthID are a separate mechanism: they live in the pixels and are not affected by metadata removal.
This guide explains the three ways AI images are labeled today, where each one lives, what removes it, and how to think honestly about the trade-off between privacy and provenance.
What C2PA and Content Credentials are
C2PA stands for the Coalition for Content Provenance and Authenticity, an industry standards body formed in 2021 whose founding members included Adobe, Arm, the BBC, Intel, Microsoft and Truepic. It publishes an open technical specification for attaching provenance information to images, video, audio and documents. "Content Credentials" is the public-facing name for that information, often shown as a small "CR" icon in apps that support it.
A C2PA record is called a manifest. Each manifest contains:
- Assertions: statements about the content, such as the actions performed (created, edited, cropped, AI-generated), the software used, and the "ingredients" (other files that went into it).
- A claim: a bundle that references those assertions and a cryptographic hash of the image data, which the C2PA specification calls a hard binding.
- A signature: made with a certificate, so a verifier can tell who signed the claim and whether anything changed since.
When a file is edited in C2PA-aware software, a new manifest is added and the previous one becomes an ingredient, building a chain of history. All manifests together form the manifest store.
Supporters include AI image generators and, increasingly, cameras and phones. For example, Google announced in 2025 that the Pixel 10's camera app adds Content Credentials to JPEG photos and that Google Photos adds them to edited images. OpenAI has added C2PA metadata to images generated in ChatGPT and its API since 2024.
Where C2PA data is stored inside an image file
The manifest store is packaged in JUMBF (JPEG Universal Metadata Box Format, standardized as ISO/IEC 19566-5), then embedded in the file in a way that depends on the format:
| Format | Where the manifest store is embedded |
|---|---|
| JPEG | One or more APP11 marker segments containing the JUMBF boxes |
| PNG | A dedicated caBX chunk |
| WebP | A dedicated chunk inside the RIFF container |
| HEIF, AVIF, MP4 | A box inside the ISO base media file structure |
The specification also allows a manifest to be stored outside the file, in a repository, with the image referring to it or being matched to it later. Keep that in mind: stripping what is inside the file does not delete a copy kept elsewhere.
Because the manifest is a separate block, it sits next to EXIF, XMP and IPTC rather than inside them. If you want a refresher on those three, our article on EXIF vs IPTC vs XMP covers where each one lives.
The other AI label: the IPTC digital source type
Separately from C2PA, the IPTC photo metadata standard defines a field called Digital Source Type, stored in XMP as Iptc4xmpExt:DigitalSourceType. Its value is a URI from a controlled IPTC vocabulary. The values most relevant to AI are:
| Value | Meaning |
|---|---|
trainedAlgorithmicMedia | Created using generative AI |
compositeWithTrainedAlgorithmicMedia | Edited using generative AI, for example inpainting |
compositeSynthetic | A composite in which at least one element is generative AI |
algorithmicallyEnhanced | Algorithmic correction such as sharpening or noise reduction |
digitalCapture | Captured from real life with a digital camera |
computationalCapture | Several real frames merged automatically, as in smartphone HDR |
C2PA reuses the same vocabulary inside its action assertions, so the two systems speak the same language. The difference is trust. A C2PA manifest is signed; a plain XMP field is not, and anyone can write, change or delete it with ordinary metadata software. Platforms such as Meta have said they look for both C2PA and IPTC indicators when deciding whether to show an AI label.
Some AI image tools also write their prompt and generation settings into PNG text chunks, outside both C2PA and IPTC. Our guide to PNG metadata shows what those chunks contain and how to find them.
Invisible watermarks are not metadata: SynthID and similar systems
An invisible watermark changes the image content itself in a way people cannot see but software can detect. Google DeepMind's SynthID is the best-known example: it is added to images generated by Google's AI tools and, according to Google, is designed to withstand modifications such as cropping, filters and lossy compression. Google provides a SynthID Detector portal, and Gemini can check uploaded images for the watermark.
The practical consequence is simple: a metadata remover cannot touch a pixel watermark. Our tool's default mode deliberately leaves the pixels exactly as they were, so a watermarked image stays watermarked after cleaning. Converting to another format re-encodes the pixels, but robust watermarks are designed to survive that too.
The two systems can also work together. The C2PA specification describes "soft bindings": a watermark or a fingerprint of the image that lets a verifier look up the original manifest in a repository even after the embedded copy was removed. Removing metadata, then, does not guarantee that an image can no longer be linked to its credentials.
What strips Content Credentials, and what does not
Embedded C2PA data is fragile in the same way EXIF is fragile. OpenAI's own help documentation acknowledges that its C2PA metadata can be removed accidentally or intentionally, and that screenshots and many social platforms remove it.
| Action | Embedded C2PA manifest | IPTC digital source type (XMP) | Pixel watermark |
|---|---|---|---|
| Taking a screenshot | Lost | Lost | Usually survives |
| Saving from an editor without C2PA support | Often lost | Depends on the editor | Usually survives |
| Uploading to a platform that re-encodes images | Often lost on the served copy, though some platforms read it first to show a label | Often lost on the served copy | Usually survives |
| Our tool, "Keep same format" | Removed | Removed | Untouched |
| Our tool, converting format | Removed | Removed | Pixels re-encoded; robust watermarks are designed to survive |
Platform behavior changes over time and differs between services. If it matters, upload a test image, download the published copy, and inspect it.
What Content Credentials can reveal about you
Provenance data is designed to be informative, which also makes it a privacy consideration. Depending on the software that wrote it, a manifest can include:
- Identity: the name or account of the creator, if an identity assertion was added, and the organization whose certificate signed it.
- Edit history: the list of actions and the apps and versions used.
- Ingredients: references to source files, sometimes with small thumbnails of them, which can show what a photo looked like before it was cropped or combined.
- Capture details: C2PA can carry EXIF-style data, including date, camera and location, in its own signed assertions.
None of this is a reason to fear the standard. It is a reason to know what you publish. A photographer who signs work to prove authenticity probably wants the manifest; a person posting a family photo from a phone that signs every picture may not want a signed record of time, device and place attached to it.
Should you strip Content Credentials? An honest trade-off
There is no single right answer, so here is a fair way to decide.
Keep them when provenance helps you
- You publish news, documentary or evidentiary images and want viewers to verify them. Our guide for journalists on metadata and source protection covers how to balance this with protecting sources.
- You are an artist or photographer who wants a verifiable record that your work is yours and how it was made. See which metadata photographers should keep.
- Your organization's policy or a client contract requires credentials to be preserved.
Removing them can be reasonable when
- The manifest contains your name, location or device details and the image is personal.
- The ingredient thumbnails show content you deliberately cropped out.
- You are sharing a file privately and do not want its edit history attached.
Removing credentials is never a way to make an AI-generated image pass as a real photo. Many platforms require you to label AI-generated or altered content, and in the EU, Article 50 of the AI Act sets transparency obligations for AI-generated and manipulated content. Those duties apply whether or not the metadata is still in the file. Also remember the reverse: an image without credentials is not proof that it is authentic or that it is AI-generated.
How to check an image for Content Credentials
- Use the official verify page. Upload the image to contentcredentials.org/verify to see any manifest, its signer and its history in a readable form.
- Use ExifTool. It reads JUMBF and XMP. The command below filters its output for provenance-related lines (on Windows PowerShell, replace
grep -i -EwithSelect-String -Pattern). - Use c2patool, the open-source command-line tool from the Content Authenticity Initiative, if you need the full manifest as JSON.
- Read the report. When you clean an image with our free metadata remover, the report lists the blocks it found and removed, which tells you whether C2PA/JUMBF data or XMP was present.
exiftool -a -G1 -s image.jpg | grep -i -E "jumbf|c2pa|digitalsourcetype"If you clean an image and want to confirm nothing provenance-related remains, the same checks apply; our guide on checking that metadata was really removed explains what a clean file looks like.
The bottom line
- C2PA Content Credentials are signed metadata; the IPTC digital source type is unsigned metadata; SynthID-style watermarks are part of the pixels.
- Metadata removal takes out the first two and leaves the third.
- Keep credentials when proving origin matters to you; remove them when they expose personal details you never meant to publish.
- Whatever you choose, disclose AI-generated content where rules require it, and never treat missing credentials as evidence either way.