C2PA checker: read content credentials and image provenance

Provenance

What are C2PA content credentials?

C2PA — the Coalition for Content Provenance and Authenticity — maintains an open standard for attaching provenance records to media files. When a tool supports the standard, it writes a small data structure into the file: a JUMBF container that holds one or more manifests. Each manifest carries a claim (a statement about how the asset was produced), a set of assertions (structured facts such as the actions taken, the software used and the ingredients the file was built from), and usually a digital signature from the producer.

These records are what applications display as content credentials. An editor might summarize them as "generated with AI" or "edited in Photoshop", but underneath, the same information is stored as JSON inside the file's binary segments — which is exactly what this C2PA checker reads and decodes for you.

Credentials are meant to travel with the file. When a C2PA-aware tool edits the image, it appends a new manifest referencing the earlier ingredients, forming a provenance chain from capture to publication.

In the wild

Which tools embed content credentials?

Adoption is still uneven, but several widely used tools already write C2PA data into images:

• Adobe Photoshop records Generative Fill and other AI-assisted edits as C2PA actions when content credentials are enabled, and Adobe Firefly attaches credentials to exported images by default.
• DALL‑E via the API embeds a C2PA manifest declaring the image as AI-generated, using the trainedAlgorithmicMedia digital source type.
• Leica and Sony cameras sign files at the moment of capture — the Leica M11-P was the first camera to ship with built-in content credentials, and recent Sony Alpha bodies offer C2PA signing through firmware updates.

Because credentials live in ordinary metadata segments, they are fragile. Re-saving in an editor without C2PA support, taking a screenshot, or uploading to a platform that strips metadata will all remove them. An absent credential therefore proves nothing about a file's history — and when you want to remove provenance data on purpose, a metadata cleaner does it in one pass.

Reading the label

What does 'trainedAlgorithmicMedia' mean?

C2PA assertions can declare a digital source type, a value from the IPTC Digital Source Type vocabulary that names the process behind the asset. The ones you will meet most often:

• digitalCapture — the image came from a camera sampling real light: an ordinary photograph.
• trainedAlgorithmicMedia — the asset was created by a trained model, i.e. generative AI. This is the flag DALL‑E and Firefly exports typically carry.
• compositeWithTrainedAlgorithmicMedia — a composite that includes AI-generated material, such as a photograph extended with generative fill.
• algorithmicMedia — produced by an algorithm without a trained model, for example a computer-rendered scene.
• minorHumanEdits — a capture with only minor retouching by a person.

Alongside source types, the action list — values such as c2pa.created, c2pa.edited and c2pa.placedIngredient — describes what happened to the file between versions. Read together, they sketch a declared timeline of the image's life. Keep in mind that both are self-reported: they are only as trustworthy as whoever signed the claim, which is why this tool shows the raw claim data instead of a simple "authentic" verdict.