C2PA and Content Credentials explained: how they affect your photos
What C2PA is
C2PA stands for Coalition for Content Provenance and Authenticity, an industry initiative that defines a technical standard for recording the provenance of a digital file. In practice, C2PA can embed a verifiable history inside an image: which device or software created it, which edits were made, and whether a generative AI tool was involved.
The public face of this standard is called Content Credentials. It is the “nutrition label” of an image: a small record, often cryptographically signed, that travels with the file and tells its story.
Where these credentials are stored
C2PA credentials are stored inside the file itself, usually in a container called JUMBF (JPEG Universal Metadata Box Format). That block travels with the image even if you never see it and even if it does not appear in the preview.
This matters: when you share a photo, you are not sharing only the pixels. You are also sharing that provenance history, unless you remove it first. You can review it with our checker, which tells you whether your image carries C2PA/JUMBF credentials.
Why platforms pay attention to them
Regulation pushes in this direction. Rules such as the EU AI Act encourage synthetic content to be clearly identified, and large platforms have adopted C2PA as a standard way to read provenance.
The result: when you upload an image, the platform inspects its Content Credentials. If it detects that a generative AI tool took part at some point, it can add the AI label automatically.
The false-positive problem
Here is the honest nuance. Content Credentials record any edit made with compatible software, not only generating an image from scratch. If you use:
- Photoshop’s generative fill on a real photo to remove an object,
- An AI-assisted adjustment in Lightroom,
- A Canva template or filter that writes credentials,
…your authentic photograph can end up with a credential that mentions AI. The platform reads it and applies the label, even if the scene is completely real. It is one of the most common causes of false positives.
Put another way: C2PA records that an edit happened; it does not judge whether the photo shows something real or fake. The platform makes that interpretation, and it is not always in your favor.
What you can do with the Content Credentials on your photos
There are two simple steps:
1. Check what the file carries. Use the checker to see C2PA/JUMBF credentials, plus EXIF, IPTC or XMP. 2. Clean what you do not want to publish. Our /c2pa mode removes the C2PA credentials and the JUMBF container from the file.
An important point about the how: cleaning is done without recompressing or touching the pixels. We remove the metadata block, but the visual content stays bit-for-bit identical (you can verify it by comparing the pixel hash before and after). We add no watermark, we do not log your files, we do not train models on them, and we delete them from the server after 5 minutes.
And, honestly: the process happens on the server, not inside your browser. The image is uploaded, processed and deleted.
What C2PA does not cover (and neither do we)
Removing Content Credentials deletes the metadata-based provenance clue. It does not remove:
- Invisible pixel-level watermarks, such as Google’s SynthID, which are embedded in the image itself.
- Other detection methods platforms may use besides metadata.
If your image was truly generated by AI and carries a pixel-level watermark, cleaning C2PA will not make it disappear. We would rather say that clearly than promise something impossible.
In short
C2PA and Content Credentials are a provenance standard embedded in your files that platforms read in order to label content. It is useful for transparency, but it also creates false positives on real photos edited with modern software. With the checker you know what your image carries, and with the /c2pa mode you remove those credentials without altering the pixels. For the technical terms, see the glossary.