You may have noticed small "Content Credentials" labels appearing on images: in Photoshop exports, on some news sites, in a few camera menus. C2PA is the technical standard behind them. It's a genuinely good idea with real industry weight behind it, and one structural weakness everyone in the field knows about. This guide explains both, without the jargon.
What C2PA actually is
C2PA stands for the Coalition for Content Provenance and Authenticity. It's an open standard, not a product: a shared format for attaching a signed history to a media file. That history, called a manifest, can record who made the file, what tool made it, whether AI was involved, and what edits happened along the way. The manifest is cryptographically signed, so tampering with it is detectable.
"Content Credentials" is the consumer-facing name for that manifest, the label you actually see on an image. Same thing, friendlier packaging.
Who's behind it
Serious names. The coalition's members include Adobe, Microsoft, Intel, the BBC, Sony, and Google, and camera makers such as Leica and Nikon have shipped C2PA support in hardware, signing photos at the moment of capture. That backing matters: a provenance standard is only useful if tools on both ends, creating and displaying, actually speak it.
What it does well
- Edit history. A C2PA manifest can show the chain from camera to crop to publish, not just a single point in time.
- Capture-time signing. A photo signed inside the camera is strong evidence of where the pixels came from.
- An open standard. Any vendor can implement it; no single company owns the format.
- AI disclosure. Manifests can record that content was AI-generated, which regulations increasingly require.
Where it breaks
The credential lives inside the file, as metadata. That's its strength (it travels with the file) and its weakness (it travels only with the file).
- Re-uploads strip it. Many platforms remove metadata when you upload. The credential is simply gone, with no error and no trace.
- Screenshots never had it. A screenshot is a new image. Whatever the original carried, the copy carries nothing.
- Support is uneven. A credential only helps if the app displaying the file bothers to check and show it.
- Identity costs money. Signing with a verified identity typically means buying a C2PA signing certificate, which runs about $289 a year.
None of this makes C2PA bad. It makes it incomplete, in a specific, predictable way: the moment your content passes through a channel that strips metadata, the credential is gone.
How hash-based stamps complement it
A hash-based stamp takes the opposite approach. Instead of embedding a credential in the file, it records the file's fingerprint (a SHA-256 hash of its exact bytes) on a public record outside the file, along with who stamped it and when. Nothing is added to the file, so there's nothing for a platform to strip.
Honesty requires the full picture: a re-compressed copy won't match a hash check either, because it's different bytes. The difference is what survives. When a credential is stripped, the evidence is destroyed; there's nothing left to check. When a copy fails a hash check, the record still exists, and producing the original file settles the question on the spot. One approach fails silently, the other fails loudly and recoverably.
The two work well together, which is why Marks are C2PA compatible: Mark can produce optional C2PA 2.4 sidecar manifests for media. Daily stamp batches anchor to Arweave; Base is an optional additional witness. Identity comes free, too: proving you control a domain or handle earns a Verified byline without a paid certificate.
Which should you use?
If your pipeline already produces Content Credentials, keep them; the edit history is valuable and nothing here replaces it. Add a hash stamp at publish time so there's a record you can check against the original bytes, even if a platform changes its copy. A transformed copy will not match the original fingerprint. If you're starting from zero, a hash stamp is the thirty-second version of provenance: no certificate, no special software, works for any file type, not just media.
And if you're on the receiving end, checking a suspicious file rather than publishing one, see how to check if a file is authentic. The verify page is free and needs no account.
Common questions
What does C2PA stand for?
The Coalition for Content Provenance and Authenticity. It's an open technical standard for attaching signed provenance metadata to media files. Content Credentials is the consumer-facing name for that metadata.
Do Content Credentials survive re-uploads?
Often not. Many platforms strip metadata when you upload, and a screenshot never carries it. When the credential is stripped, there is nothing left in the file to check. This is the standard's best-known limitation.
Is Mark a replacement for C2PA?
No, it's a complement. C2PA travels inside the file and records edit history; a Mark lives outside the file on a public record, so it still exists after a platform strips metadata. Mark is C2PA compatible and can produce C2PA 2.4 manifests for media.
Do I need special software to check Content Credentials?
You need a C2PA-aware inspector, such as the official Content Credentials verify site or supporting tools in creative apps. Checking a hash-based Mark needs only the file and the free verify page: drop the file, see the record.