What is C2PA? Content Credentials explained.
C2PA is an open standard that lets an image be signed with information about how it was created and edited. It is one of the industry’s answers to AI-generated images, but it has an important limit: it only proves something when the signature exists.
Vouch teamOctober 23, 20265-minute read
In short
- C2PA is a standard to record the origin and history of an image, also known as Content Credentials.
- It was created in 2021 by Adobe, Arm, BBC, Intel, Microsoft and Truepic.1
- Some cameras, phones and AI tools already sign their images.
- A photo without credentials is not fake: it simply has no record of origin. That’s why it doesn’t replace image analysis.
What C2PA is
The Coalition for Content Provenance and Authenticity (C2PA) was formed in February 2021 to create a technical standard that certifies the origin and history of digital content. Its founders were Adobe, Arm, BBC, Intel, Microsoft and Truepic.1
The standard is open and royalty-free. The Content Authenticity Initiative, driven by Adobe, promotes its adoption under the name Content Credentials.
How it works
The signature
When a camera, phone or program creates or edits an image, it adds a digitally signed record with data such as the device, the date and the edits.
The history
Each later edit with compatible tools adds a step to the record, like a chain of custody.
Verification
Anyone can upload the image to the Verify tool at contentcredentials.org/verify and see whether it has credentials and what they say.2
Who uses it
Cameras
The Leica M11-P, launched in 2023, was one of the first cameras to sign photos with Content Credentials in hardware.3
Phones
Some Google phones sign photos at capture,4 and Samsung adds credentials to images edited with its AI starting with the Galaxy S25 series.5
AI tools
Several generation tools label their images as AI-made, and regulation is pushing that way: the EU AI Act requires AI-generated content to be disclosed.6
Its limits
Few photos have it
Most photos submitted as evidence are taken with phones that don’t sign them.
The signature gets lost
Credentials travel inside the file, and many social networks and messaging apps strip that data when a photo is uploaded or sent.7
Its absence proves nothing
A photo without a signature is not fake: it simply has no record of origin.2
It doesn’t say the damage is real
A signed photo proves what it was taken with, not that the scene is what the claim says: someone can photograph a screen or a staged scene.
For the other signals, see the guide to telling whether a photo was generated or edited with AI.
With Vouch: since most photos carry no signature, the analysis doesn’t depend on one: it looks at the image itself, searches for it online and in previous claims, and cross-checks the customer’s context.
How Vouch solves it
Vouch analyzes every photo in under 30 seconds with three layers: detection of images generated or edited with AI, a search for the image online and in previous claims, and the customer’s context. It returns a 0–100 risk score with the reason, and gray-area cases go to a specialist. It works from Vouch Web, with no integration, or via API.
Frequently asked questions
What does C2PA stand for?
Coalition for Content Provenance and Authenticity, the coalition that created an open standard in 2021 to record the origin and history of digital content.
What are Content Credentials?
The public-facing name of the C2PA standard: a signed record inside the image that shows what it was taken or created with and what edits it went through.
How do I check whether a photo has C2PA?
Upload it to the Verify tool at contentcredentials.org/verify. It shows whether the image has credentials and what information they contain.
If a photo has no C2PA, is it fake?
No. Most photos have no credentials, and those that do often lose them when forwarded or cropped. A photo without a signature simply has no record of origin.
Does C2PA replace AI image detectors?
No. It’s a complement: when the signature exists, it adds valuable information, but most photos submitted as evidence don’t have one. That’s why you want a tool that analyzes the image itself, like Vouch, which also searches for it online and in past claims and cross-checks the customer’s context.
Sources
This article is based on public sources only; every figure can be verified.
- C2PA. Technology and media entities join forces to create standards group aimed at building trust in online content (Feb 2021)
- Content Authenticity Initiative. Using the Verify tool
- TechSpot. Leica’s M11-P is the first full-frame camera with built-in content protection (Oct 2023)
- Google Security Blog. Pixel and Android: trusted images with C2PA Content Credentials (Sep 2025)
- Android Authority. Galaxy S25 Content Credentials (2025)
- Jones Walker LLP. The EU approved a high-risk AI delay, but most transparency obligations remain (2026)
- IPTC. IPTC study shows some social media networks remove rights information from photos (Mar 2013)