As generated images became indistinguishable from photographs, the industry response shifted from *detecting fakes* to *proving provenance*. C2PA (Coalition for Content Provenance and Authenticity) is the standard that resulted.
What It Records
Content Credentials attach a manifest to an image file describing its history:
- Origin: what device or software created it — a camera model, or a named AI generation tool.
- Edits: what was done to it afterwards, potentially step by step — cropped, colour adjusted, background removed, generative fill applied.
- Ingredients: if the image combines other images, references to those.
- Issuer: who signed the manifest, and when.
The manifest is cryptographically signed, so any modification to the image or the record breaks the signature and is detectable.
Where You'll Encounter It
- Cameras: several professional camera bodies can sign images at capture.
- Editing software: major editors can record edit history into the manifest.
- AI generators: many now attach credentials marking output as AI-generated — increasingly required by regulation in some jurisdictions.
- Platforms: some social networks and search results display a marker for images carrying credentials.
What It Proves — and What It Doesn't
It can show: that an image with an intact signature came from a specific device or tool and was modified in specific ways; that a given generator produced it; that the file hasn't been altered since signing.
It cannot show: that an image *without* credentials is fake. This is the crucial asymmetry. Metadata is trivially removed — a screenshot, a re-save, a social media upload, or a one-line command strips it. Most images on the internet have no credentials and never will.
It also cannot verify the *content* of a photograph. A camera can faithfully sign a photograph of a staged scene, or of a screen displaying a generated image. Provenance proves the pipeline, not the truth of what was in front of the lens.
Practical Implications
If you create images:
- Consider enabling credentials for work where authenticity has value — journalism, evidence, product photography, licensed stock.
- Expect that generation tools will mark AI output whether you want it or not, and that some platforms and clients now require the marking to be preserved.
- Be aware that credentials can reveal more than you intend: software used, edit steps, sometimes identity. Check what your tools include before publishing.
If you evaluate images:
- Present and valid credentials are strong positive evidence.
- Absent credentials are weak evidence of nothing — the default state of almost every image.
- Combine with reverse image search, source reputation and corroborating reports.
Where This Is Heading
Adoption is growing on both the capture side and the platform side, and several regulatory frameworks now push toward mandatory labelling of synthetic media. The realistic outcome is a two-tier ecosystem: images with verifiable provenance that can be trusted more, and everything else — which will not automatically be suspect, but will carry no assurance at all. Building the habit of checking provenance now is cheap; needing it later and not having it is not.