Side by side
| EXIF | C2PA | |
|---|---|---|
| Job | Camera settings, time, optional GPS | Signed origin and action history |
| Who writes it | Camera / phone / some editors | Tools that implement Content Credentials |
| Typical privacy issue | Location, serial, timestamp | A provenance claim you did not want to send |
| Typical authenticity issue | Almost none — it is not a signature of origin | Whether the claim still matches the bytes |
| Survives screenshot? | Usually no | Usually no |
| Removed by Canvas re-encode? | Usual header block, yes | Usual packet, yes |
When you need which viewer
Location or camera model: start with Metadata Cleaner. “Was this issued with credentials / does it still carry a C2PA packet”: AI Image Origin Detector.
A file can have both, one, or neither. Neither is a moral category.
A check you can repeat on this site
Take a camera JPEG from your phone. Open it in Metadata Cleaner: you will typically see EXIF (make, time, settings) and, if location tagging was on, GPS. Open the same file in AI Image Origin Detector: most camera JPEGs have no C2PA packet — that miss is normal, not a human-original certificate.
If a file has a packet (some generator exports do), the detector reads JUMBF / caBX locally first. Official OpenAI verify is a separate optional click; this page is not claiming it already ran that remote check for you.
The mix-up that causes bad advice
EXIF GPS can leak a home. C2PA can describe a generator. Clearing GPS does not unsay a credential, and clearing a credential does not move a pin off a map that was never in EXIF. If you need both gone from a sharing copy, strip supported metadata, then look at the pixels.