The short definition
Ask two questions of the file in front of you: where did it come from, and what happened to it after that? A provenance record is a written answer to those questions. It might name a camera, an edit, or a generative tool. It might be signed. It might be missing.
People use the word for different layers. A newsroom may mean chain of custody. A photographer may mean an IPTC credit. A product page may mean C2PA plus a watermark. On this site the useful split is below, and the field workflow is the AI provenance guide.
What it is not
- It is not always present. Most files still have no provenance record.
- It is not the same thing as EXIF. Camera tags and a signed origin record can sit in one file, or either one can be absent.
- A provenance record is not, by itself, proof that a picture is “real.” It can describe a camera capture or a generated file.
- C2PA is one technical standard for a signed provenance record. It is not a synonym for every use of the word.
- Content Credentials are a common way products show that record to a person. The comparison is C2PA vs Content Credentials.
- A file with no C2PA packet is inconclusive. That absence does not show a generative tool made the file, and it does not show a camera did either.
What you can actually recover
- Header metadata (EXIF/XMP) — easy to strip, easy to inspect.
- C2PA manifests — signed, also strippable, absent on most files.
- Pixel watermarks — not metadata, not guaranteed detectable.
- The picture itself — style, artifacts, UI. Soft evidence.
How to inspect the file you have
AI Image Origin Detector reads the provenance structures this browser can see, including C2PA when the packet is still there. Local inspection stays on the device. Official OpenAI verification is a separate click and does send the file. A miss stays a miss: useful, and not a verdict.