C2PA Specification and Content Credentials

What is C2PA, and what does the viewer check?

C2PA is the Coalition for Content Provenance and Authenticity specification. Content Credentials name that signed manifest: signer, software agent, and actions such as created or edited. The viewer reads JUMBF or caBX in the browser. A missing packet is inconclusive. The longer definition is on the C2PA learn page.

C2PA: Coalition for Content Provenance and Authenticity; C2PA specification 2.4

Last updated 2026-10-29

C2PA is the Coalition for Content Provenance and Authenticity specification. The longer definition is on the C2PA learn page. The check is the C2PA viewer.

Updated 29 October 2026

What the words mean

C2PA is the Coalition for Content Provenance and Authenticity, and the technical specification that coalition publishes. A conforming file can carry a manifest: who signed it, the software agent, and actions such as created or edited. The coalition’s public home is c2pa.org. The published specification 2.4 is at spec.c2pa.org.

Content Credentials are the name people use for that signed manifest. Content provenance is the wider record of where a file says it came from and how it changed. C2PA is one way to store that record. The longer definitions stay on what C2PA is, Content Credentials, and content provenance.

On 29 October 2026 the specifications index at spec.c2pa.org listed “C2PA Specifications 2.4” and “C2PA Specifications 2.5”, and the download label on that page still read “Technical Specifications (2.3)”. The coalition home at c2pa.org said that day that C2PA provides an open technical standard to establish the origin and edits of digital content, and that the standard is called Content Credentials. The C2PA viewer reads a manifest that is already in the file. It does not invent a SynthID score.

What the viewer does

The C2PA viewer reads JUMBF or caBX in the browser. The local read does not upload the file. Official OpenAI provenance verification is a separate click. That path sends the original bytes.

A missing packet is inconclusive. It does not prove a camera original, and it does not prove an AI image. The viewer does not invent an AI percentage.

Check a file from this page

Open the C2PA viewer or the Content Credentials checker. Both read the packet in the browser.
Read the signer, software agent, and actions the file actually stores. A missing packet stops there.
If you want OpenAI’s check, click that control. The click sends the original bytes. Skipping it sends nothing.
Do not treat “not detected” as proof a person took the photo, and do not treat a manifest as proof the pixels were never edited outside the recorded actions.

EXIF and GPS are a different layer. Use the photo location viewer for coordinates and the verify page if you compare a file before and after a strip. Stripping a packet only removes that packet from your copy.

What it does not do

It is not EXIF. GPS and camera fields are a different layer.
It is not a social-app AI label. Instagram, Facebook, TikTok, and YouTube can label from self-disclosure or their own detection.
Viewing a manifest does not remove an AI watermark. Stripping a packet only removes that packet from your copy.
It is not proof that a person took the photo.

The same inspector also opens from the Content Credentials checker.

Questions

What is C2PA?

C2PA is the Coalition for Content Provenance and Authenticity specification. A conforming file can carry a signed manifest. A missing packet is inconclusive.

What are Content Credentials?

Content Credentials are the name for that signed manifest: signer, software agent, and actions such as created or edited. They are not a separate stamp from C2PA.

What does the viewer do?

The viewer reads JUMBF or caBX in the browser. Nothing is uploaded until you click the optional OpenAI check, and that click sends the original bytes. The viewer does not remove an AI watermark, and a missing packet is not proof a person took the photo.