C2PA content credentials

Remove C2PA content credentials from any file

Drop an image, a video or a document to see the C2PA manifest a verifier would read, then remove it in one click.

Drop an image here

or browse, or paste with ⌘V

JPEG, PNG, WebP, AVIF, HEIC, GIF · TIFF read-only

Never stored No sign-in Pixels untouched

C2PA content credentials are a signed provenance record stored in a file's metadata. They sit in a metadata segment beside the media stream; in images they sit alongside EXIF and XMP. Removing the manifest clears that record and leaves every frame and pixel untouched.

The basics

What is C2PA?

C2PA is an open standard that puts a signed record inside a file:
which tool made it, which edits followed,
and who vouches for both.

C2PA stands for the Coalition for Content Provenance and Authenticity, whose members include Adobe, Microsoft, the BBC, Intel, Truepic, Sony, Google and OpenAI. The record is metadata, not a visible watermark.

Where credentials live

The same manifest, in a different place per format

An image, a clip and a PDF all carry the identical signed record. Where it sits inside the file is what decides whether an export or an upload leaves the credential intact.

Images

JPEG, PNG, WebP, AVIF, TIFF and HEIC hold the manifest in an APP11 or equivalent metadata segment, alongside EXIF and XMP. Firefly, DALL·E, Imagen and recent Leica, Sony, Nikon and Canon bodies all sign stills this way.

Video

MP4 and MOV keep the manifest in a JUMBF box in the container, next to the moov atom rather than inside the frames. Some workflows ship a sidecar file instead.

Documents and audio

Signed PDFs carry the manifest as an embedded object, and MP3 and SVG use their own metadata containers. The assertions are identical, only the wrapper differs.

What every manifest records

The generating model or camera, each editing action a supporting tool applied, and the certificate that signs the set. AI generators declare themselves as trainedAlgorithmicMedia regardless of the output format.

What survives an edit

A re-encode or a platform re-compress usually breaks the hash binding, so the credential reads as invalid rather than absent. Editors that support the standard re-sign on export and append a new manifest to the chain.

Why platforms care

LinkedIn, TikTok, YouTube and Meta read the manifest on upload and can label a post as AI-generated from it, without ever looking at the pixels.

The scanner above reads all of them, reports the signer, and drops the provenance data: the metadata segments are spliced out and every other byte is copied through unchanged.

Benefits

What the tool gives you

Transparency

Understand what C2PA carries

A worked example of a real manifest: the claim generator, the actions, the signer and the AI declarations.

Claim generatorAdobe Firefly 3.4
Signed byAdobe Inc.
AI usetrainedAlgorithmicMedia
TrainingnotAllowed
Formats

Images, video and documents

JPEG, PNG, WebP, AVIF, HEIC, GIF, MP4, MOV, MP3, SVG, HTML, Markdown, DOCX, ODT and PDF. TIFF is read-only: it is inspected but never modified.

JPG
PNG
MP4
PDF
HEIC
DOCX
Privacy

Held in memory, never stored

Reading the manifest means parsing the file, so it is uploaded to be inspected and cleaned. It is processed in memory and never written to disk or kept after the response.

your browser
0 uploads
Quality

Pixels stay untouched

Metadata segments are spliced out and everything else is copied byte for byte, so images and audio come back bit-identical. Documents are the exception: those containers are rebuilt.

Before
c2pa manifest
After
c2pa manifest
C2PA content credentials diagram

How the C2PA standard works

Five stages. Break any one of them and verification fails, which is the point: a file either carries an intact history or it does not.

01

Capture or generate

A camera or an AI model creates the file and records what it did.

02

Assert

Each action becomes an assertion: edits, crops, AI use, training permissions.

03

Sign

The assertions are hashed and signed with a certificate, forming a manifest.

04

Embed

The manifest is written into the file, or into a store beside it.

05

Verify

A reader re-hashes the file. Matching hashes mean the history is intact.

Hash
A digest of the file contents
Claim
The signed set of assertions
Certificate
Identifies the signer
Content credentials metadata

A C2PA content credentials metadata example

This is what a reader extracts from a signed image: the tool that made the file, the actions it performed, and the certificate that vouches for both.

c2pa manifest · product-shot-final.jpg
{
  "active_manifest": "urn:c2pa:8f2d41b6-1a7e-4c93-9f10-2ab5",
  "manifests": {
    "urn:c2pa:8f2d41b6-1a7e-4c93-9f10-2ab5": {
      "claim_generator": "Adobe_Firefly/3.4 c2pa-rs/0.36.0",
      "title": "product-shot-final.jpg",
      "format": "image/jpeg",
      "assertions": [
        {
          "label": "c2pa.actions",
          "data": {
            "actions": [
              { "action": "c2pa.created", "digitalSourceType":
                "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia" },
              { "action": "c2pa.edited", "softwareAgent": "Adobe Photoshop 26.2" }
            ]
          }
        },
        { "label": "c2pa.training-mining",
          "data": { "entries": { "c2pa.ai_training": { "use": "notAllowed" } } } }
      ],
      "signature_info": {
        "issuer": "Adobe Inc.",
        "cert_serial_number": "70:9a:c3:5f:11:d8",
        "time": "2026-03-18T09:41:02Z"
      }
    }
  }
}
claim_generator

The exact software and library version.

digitalSourceType

Declares the file as AI-generated media.

signature_info

Issuer, certificate serial and timestamp.

Adoption

Where content credentials already appear

Most people meet the standard for the first time when a platform labels their upload, or when a client asks why an export mentions a generative model.

Cameras

Recent Leica, Sony, Nikon and Canon bodies can sign photographs at the moment of capture.

AI tools

Adobe Firefly, DALL·E, Imagen, Google Veo and other image and video generators attach credentials by default.

Platforms

LinkedIn, TikTok, YouTube and Meta read credentials on upload and can label a photo or a clip as AI-generated.

Editors

Photoshop, Lightroom, Premiere and other supporting apps extend the manifest on every export.

C2PA adoption news, in short

2021Adobe, Microsoft, the BBC, Intel and Truepic form the coalition and publish the first specification.
2023Content Credentials ship in Adobe Firefly and in Leica's M11-P, the first camera to sign in hardware.
2024Platforms begin reading credentials to label AI-generated posts; the specification reaches version 2.0.
2025Camera, phone and model providers broaden support, and conformance programmes begin.
Removing credentials

Why people remove C2PA content credentials

Provenance data is useful in journalism and evidence work. In commercial production it is often unwanted detail travelling with a deliverable.

Client delivery

A manifest lists every tool and version you used. Most delivery contracts do not require that.

Privacy

Credentials can carry device identifiers, timestamps and account details you did not intend to share.

Avoiding wrong labels

A file touched by an AI-assisted filter can be labelled AI-generated even when the work is your own photograph.

Clean re-use

Stale manifests break verification after ordinary re-encoding, which looks worse than no manifest at all.

Images

JPEG · PNG · WebP · AVIF · HEIC · GIF

Manifest, EXIF and XMP spliced out; every other byte copied unchanged

Video

MP4 · MOV · M4V

Manifest box neutralised in place, stream untouched

Other files

PDF · MP3 · SVG · DOCX · ODT

Provenance and document properties removed

FAQ

Questions about the C2PA standard

It is an open standard that lets a file carry a signed record of how it was made. Software that supports the standard can read that record and show the file's history, or warn that the history is missing.

Check what your files carry

Inspect the C2PA manifest in an image, video or document, then remove it in one click.

Open the C2PA remover