Content Credentials
| C2PA Manifest Store | |
|---|---|
 | |
| Filename extension |
.c2pa |
| Internet media type |
application/c2pa |
| Developed by | Coalition for Content Provenance and Authenticity (C2PA) |
| Initial release | December 21, 2021 |
| Latest release | 2.4 April 21, 2026 |
| Type of format | Digital media provenance and asset history |
| Container for | |
| Contained by | |
| Open format? | Yes |
| Website | contentcredentials |
Content Credentials are cryptographically signed metadata structures, known as C2PA manifests, that provide a verifiable record of a digital asset's provenance and modification history. Defined by the C2PA specifications, this architecture establishes a core set of technical assertions, while supporting custom schemas to extend metadata regarding authorship, content intent, and machine-readable usage preferences.
The core C2PA specification is authored and maintained by the Coalition for Content Provenance and Authenticity (C2PA), an industry group composed of major technology firms and media companies. It operates as a project of the Joint Development Foundation (JDF), an affiliate of the Linux Foundation.
A supplementary specification addressing identity, publishing, licensing, and schema-based assertions is defined in the Creators Assertions Working Group (CAWG) specification. This specification is overseen by the Decentralized Identity Foundation (DIF) and maintained by Adobe.
Parallel promotional initiatives, including sponsored brand campaigns in media outlets, educational outreach, and legislative adoption efforts, are led by the Content Authenticity Initiative (CAI), a cross-sector coalition established by Adobe.
Distinction between provenance and factual accuracy
Adobe's marketing of Content Credentials as a digital "nutrition label" is a false equivalence as such labels catalog objective chemical composition while Content Credentials merely verify provenance and digital integrity without assessing the objective truth of the content itself. Consequently, a fabricated or misleading image can maintain a valid cryptographic credential that confirms its origin while validating deceptive content as technically authentic.
C2PA Conformance Program
In early-to-mid 2024, the C2PA established the Conformance Task Force to transition its open technical specifications into a verifiable compliance model to foster market trust. The task force utilized the Trust over IP (ToIP) Governance Metamodel to structure its compliance policies.
The C2PA Conformance Program soft-launched on June 4, 2025, at the Content Authenticity Initiative (CAI) Summit, followed by a full public launch in October 2025. The transition concluded on December 31, 2025, when the C2PA Interim Trust List was officially deprecated.
In October 2026, security researcher David Buchanan demonstrated a vulnerability in the C2PA specification that allows an attacker to alter an image without invalidating its cryptographic signatures or trusted timestamps. By exploiting a feature that permits arbitrary byte range "exclusions," a signer can exclude an entire file from signature calculations. This generates a valid timestamp over an empty string, allowing the image to be tampered with after the fact without triggering current C2PA verification tools. Buchanan noted that a complete fix is complex due to format-specific requirements, suggesting that verifiers must strictly enforce constraints on allowed exclusion ranges.
Conforming Implementations
While the C2PA Conformance Explorer registry indexes over 200 active products, ecosystem data indicates that 10 organizations have deployed products that simultaneously complete the Conformance Program and achieve on-boarding onto the central C2PA Trust List.
| Organization / Company | Deployed Conforming Product(s) | C2PA Version |
|---|---|---|
| OpenAI | ChatGPT / GPT images | 2.4 |
| Google LLC | Gemini, Pixel Camera, Google Photos | 2.2 |
| Guardian Project | Proofmode Capture App | 2.2 |
| Vivo Mobile Communication | Vivo / JOVI Camera/Albums App | 2.2 |
| VBrick Systems, Inc. | VBrick Video Platform | 2.2 |
| Encypher Corporation | Encypher Mark | 2.2 |
| National Public Broadcasting Company of Ukraine | Suspilne Media | 2.2 |
| Austrian Parliament | Austrian Parliament Mediathek | 2.2 |
| Stability AI | Brand Studio, Stable Audio and Developer Platform API | 2.2 |
| Cloudinary Ltd. | Cloudinary | 2.2 |
Ecosystem and adoption
Content Credentials architecture spans four distinct components of the digital media lifecycle that handle the creation, transit, presentation, and verification of digital assets.
Media Providers
Hardware devices (e.g., cameras with hardware security module), editing software, and generative artificial intelligence (AI) platforms acting as C2PA claim generators. Providers ingest metadata such as timestamps or editing history.
Generative AI Platforms
| Service | Developer | Implementation | AI Disclosure | C2PA Conformance Program | Trust Lists |
|---|---|---|---|---|---|
| Adobe Firefly | Adobe Inc. | 2023-03 | no | no | C2PA Interim Trust List |
| Respeecher | Respeecher | 2023-07 | No | No | No |
| Microsoft Designer | Microsoft Corporation | 2023-09 | No | No | C2PA Interim Trust List |
| Stability AI Brand Studio, Stable Audio, Platform API | Stability AI Ltd. | 2023-11 | No | 2.2 | C2PA Trust List |
| DALL-E / ChatGPT | OpenAI | 2024-02 | No | 2.4 | C2PA Trust List |
| Microsoft Azure | Microsoft Corporation | 2024-02 | no | no | C2PA Interim Trust List |
| Runway | Runway AI, Inc. | 2024-06 | no | 2.2 | No |
| ElevenLabs | ElevenLabs Inc. | 2024-07 | no | no | C2PA Interim Trust List (Expire 2026-10-06) |
| Flux API | Black Forest Labs | 2024-09 | Model Name | No | No |
| Amazon Titan Image Generator | Amazon.com, Inc. | 2024-09 | No | 2.2 | C2PA Interim Trust List (Expire 2026-12-06) |
| Bria AI | Bria Artificial Intelligence Ltd. | 2025-01 | No | No | C2PA Interim Trust List |
| Dreamina | ByteDance Ltd. | 2025-04 | No | No | No |
| Google Gemini | Google LLC | 2025-08 | No | 2.2 | C2PA Trust List |
| Grok Imagine | SpaceXAI LLC | 2026-04 | No | No | No |
| Seedance / Seedream | ByteDance Ltd. | 2026-04 | No | No | No |
| Higgsfield AI | Higgsfield, Inc. | 2026-07 | No | No | No |
| Pixelcut | Pixelcut Inc. | 2026-08 | No | No | No |
| Suno | Suno, Inc. | 2026-08 | No | No | No |
| Topaz Labs | Adobe Inc. | 2026-08 | No | No | No |
| fal | Features & Labels Inc. | 2026-08 | No | No | No |
| Claude | Anthropic | 2026-09 | No | No | No |
| Recraft | Recraft | 2026-09 | No | No | No |
| Creatify | Creatify Lab Inc. | 2026-09 | No | No | No |
| Ideogram | Ideogram, Inc. | 2026-09 | No | No | No |
Cameras
Despite high-profile camera announcements, a significant structural rift exists within the current C2PA landscape. As of mid-2026, major dedicated camera manufacturers (Leica, Nikon, and Canon) do not participate in the official C2PA Conformance Program. And while their signatures can be valid within their own ecosystem or legacy C2PA versions (Adobe software, Sony Ci Media Cloud, Canon Authenticity Imaging System ), they may not be trusted by any conformant platform.
As of 2026, no dedicated camera implementations had achieved compliance under the C2PA Conformance Program.
| Manufacturer | Model | C2PA Implementation Date | C2PA Conformance Program | Certificates |
|---|---|---|---|---|
| Sony | Sony α1 | 2024-03-28 | no | Sony Trust List
The free C2PA certificates provided by Sony can be used to sign any asset and cannot be used on their own to prove an image was taken by a Sony camera. To establish origin and proof of capture, an image must contain both a valid Sony C2PA certificate and Sony's proprietary authenticity signature, a combination that can only be validated on Sony Ci Media Cloud. |
| Sony α7S III | 2024-03-28 | |||
| Sony α1 II | 2025-01-15 | |||
| Sony α9 III | 2025-01-15 | |||
| Sony α7 IV | 2025-03-04 | |||
| PXW-Z300 | 2025-07-22 | |||
| Sony FX3 | 2025-10-30 | |||
| Sony FX30 | 2025-10-30 | |||
| Sony α7R V | 2025-11-26 | |||
| Sony α7 V | 2026-05-14 | |||
| Sony α7R VI | 2026-06-04 | |||
| Leica Camera | Leica M11-P | 2023-10-26 | no | C2PA Interim Trust List |
| Leica M11-D | 2024-09-12 | |||
| Leica SL3-S | 2025-01-16 | |||
| Leica M EV1 | 2025-10-23 | |||
| Leica Q3 Monochrom | 2025-11-20 | |||
| Leica SL3-P | 2026-06-25 | |||
| Canon Inc. | Canon EOS R1 | 2025-07-17 | no | Canon Trust List |
| Canon EOS R5 Mark II | 2025-07-17 |
Nikon announced in August 2025 a firmware update for the Z6III that enabled embedding Content Credentials directly into its photos. But only a few days later, a vulnerability was discovered in the software of the camera that allowed a user to combine unauthentic images with authentic photos and still have the resulting image with a valid digital signature. Nikon suspended its authenticity service and revoked the certificates.
Mobile apps with Camera Support
| Application | Developer | C2PA Implementation | License | Requirements | C2PA Conformance Program | Certificates |
|---|---|---|---|---|---|---|
| Proofmode Capture | Guardian Project | 2023-08 | GNU General Public License |
|
2.2 | C2PA Trust List |
| Pixel Camera | Google LLC | 2025-09 | Proprietary | Google Pixel 10 or higher | 2.2 | C2PA Trust List |
| Vivo / JOVI Camera | Vivo Mobile Communication Co., Ltd., | 2025-10 | Proprietary | 2.2 | C2PA Trust List | |
| VWFNDR™ + MBL | Nuevo.Studio LLC | 2026-05 | Proprietary |
|
2.4 | VWFNDR MBL Trust List |
In August 2026, security researcher David Buchanan demonstrated that the C2PA implementation on Android is vulnerable to forgery. Using software exploit, an attacker can gain root access. While the raw cryptographic keys remain secure inside the hardware module, root access allows an attacker to command the system to sign arbitrary data, generating fabricated images with valid authenticity signatures. Google recognized the vulnerability but designated the report as "Won't fix (infeasible)", stating that a true mitigation would require an impractical re-architecture of the operating system software stack.
Mobile apps
| Application | Developer | C2PA Implementation | License | Requirements | C2PA Conformance Program | Certificates |
|---|---|---|---|---|---|---|
| Photo Assist | Samsung corporation | 2025-01 | Proprietary | Galaxy S23 or higher | No | C2PA Interim Trust List |
| Google Photos | Google LLC | 2025-09 | Proprietary | Google Pixel 10 or higher: generate and validate
iOS: validate |
2.2 | C2PA Trust List |
| Pixel Recorder | Google LLC | 2025-11 | Proprietary | Google Pixel 10 or higher | 2.2 | C2PA Trust List |
Desktop Application software
As of mid-2026, no desktop application had achieved compliance under the C2PA Conformance Program.
| Application | Developer | C2PA Implementation | License | C2PA Conformance Program | Trust Lists |
|---|---|---|---|---|---|
| Adobe Photoshop | Adobe Inc. | 2020-10 | Proprietary | No | C2PA Interim Trust List |
| Adobe Stock | Adobe Inc. | 2022-10 | Proprietary | No | C2PA Interim Trust List |
| Adobe Express | Adobe Inc. | 2023-07 | Proprietary | No | C2PA Interim Trust List |
| Adobe Illustrator | Adobe Inc. | 2023-11 | Proprietary | No | C2PA Interim Trust List |
| Adobe Substance 3D Modeler | Adobe Inc. | 2024-03 | Proprietary | No | C2PA Interim Trust List |
| Adobe InDesign | Adobe Inc. | 2024-04 | Proprietary | No | C2PA Interim Trust List |
| Adobe Lightroom | Adobe Inc. | 2024-05 | Proprietary | No | C2PA Interim Trust List |
| Adobe Camera Raw | Adobe Inc. | 2024-05 | Proprietary | No | C2PA Interim Trust List |
| Microsoft Paint | Microsoft Corporation | 2024-06 | Proprietary | No | No |
| Wacom Yuify | Wacom Co., Ltd. | 2024-06 | Proprietary | No | No |
| Adobe Bridge | Adobe Inc. | 2024-10 | Proprietary | No | C2PA Interim Trust List |
| Adobe Content Authenticity Apply | Adobe Inc. | 2024-10 | Proprietary | No | C2PA Interim Trust List |
| Capture One | Capture One A/S | 2024-10 | Proprietary | No | C2PA Interim Trust List (Expire 2027-05-23) |
| Adobe Premiere | Adobe Inc. | 2025-04 | Proprietary | No | C2PA Interim Trust List |
| Adobe Media Encoder | Adobe Inc. | 2025-04 | Proprietary | No | C2PA Interim Trust List |
| Adobe Fresco | Adobe Inc. | 2025-05 | Proprietary | No | C2PA Interim Trust List |
| SpyderPro | Datacolor, Inc. | 2025-11 | Proprietary | No | C2PA Interim Trust List (Expired 2026-08-31) |
| Canva | Canva, Inc. | 2025-11 | Proprietary | No | No |
Media organizations
The integration of C2PA Content Credentials within journalistic workflows has faced adoption delays, which industry analysts attribute to limited coordination between technology developers and newsrooms, while unvetted implementations risk creating opaque verification processes for the public. Furthermore, the inclusion of persistent operational data has been cited as a potential security risk for confidential sources,.
On March 4, 2024, BBC Verify launched a transparency tool based on Content Credentials to verify the provenance of its news media. Open-source intelligence (OSINT) analysts subsequently demonstrated that a featured news video concerning gang violence in Haiti was a composite containing a recycled, fabricated audio track of gunfire dubbed over the footage. Over a 48-hour period, the BBC silently modified and republished three separate iterations of the video while removing prior C2PA manifest data. On March 28, 2024, the broadcaster issued a formal correction acknowledging the misleading audio and muted the affected passage. Following the incident, the feature's broad deployment was halted and reframed as a pilot initiative.
| Service | Developer | Implementation | C2PA Conformance Program | Certificates |
|---|---|---|---|---|
| Defense Visual Information Distribution Service | U.S. Department of Defense | 2024-08 | No | DVIDS Trust List |
| JT certifiés | France Televisions SA | 2025-09 | No | C2PA Interim Trust List (Expire 2027-12-25) |
| Suspilne Media | Public Broadcasting Company of Ukraine | 2026-07 | 2.2 | C2PA Trust List |
| Austrian Parliament Mediathek | Austrian Parliament | 2026-09 | 2.2 | C2PA Trust List |
Media Infrastructure
Content Delivery Networks, cloud storage repositories, digital asset management alongside Advertising networks and IP cameras networks systems that preserve the cryptographic manifest during transit. Because standard web routing and optimization tools frequently strip metadata or re-compress files to save bandwidth, these infrastructure layers are configured to pass the C2PA container through transit.
| Service | Developer | Implementation | C2PA Conformance Program | Trust Lists |
|---|---|---|---|---|
| Pixelstream | Pixelstream, Inc. | 2022-09 | 2.2 | C2PA Interim Trust List (Expired 2026-05-06) |
|
Adobe Inc. | 2024-04 | No | C2PA Interim Trust List |
| Cloudinary | Cloudinary Ltd. | 2024-07 | 2.2 | C2PA Trust List |
| Google Ads | Google LLC | 2024-09 | No | No |
| Cloudflare | Cloudflare, Inc. | 2025-02 | No | No |
| Fastly | Fastly, Inc. | 2025-08 | No | C2PA Interim Trust List (Expire 2035-05-07) |
| Ring | Ring Cameras | 2025-12 | 2.2 | No |
| VBrick Video Platform | VBrick Systems, Inc. | 2026-02 | 2.2 | C2PA Trust List |
| Encypher Mark | Encypher Corporation | 2026-05 | 2.2 | C2PA Trust List |
| Fotoware | Fotoware AS | 2026-09 | 2.2 | C2PA Interim Trust List (Expire 2027-12-21) |
| Zoom (Cloud Recordings) | Zoom Communications, Inc. | 2026-10 | No | No |
Publishing Platforms
Consumer-facing websites, publishers, and social media networks that host and distribute media. These platforms parse the C2PA manifest to generate an ingredient history tree and render standardized visual indicators, such as the Content Credentials icon, to display provenance history to end-users.
| Service | Developer | C2PA Implementation Date | User experience C2PA Metadata Surfaced | Trusted Certificates Lists |
|---|---|---|---|---|
| Behance | Adobe Inc. | 2020-10 | Content Credential logo Mouse Hover labels list
|
None |
| Microsoft Corporation | 2024-05 | Content Credential icon Mouse click labels list
|
Not disclosed | |
| TikTok | ByteDance | 2024-05 |
|
Not disclosed |
| Meta | Meta Platforms, Inc. | 2024-02 |
|
Not disclosed |
| YouTube | Google LLC | 2024-10 |
AI Mouse click labels list
|
Not disclosed |
| Google search | Google LLC | 2024-11 |
About this image Mouse click labels list
|
|
| Pinterest, Inc. | 2025-04 |
|
Not disclosed | |
| X (social network) | SpaceXAI LLC | 2026-01 |
|
None |
| DiVine | Verse Communications PBC | 2026-04 |
|
C2PA Trust List |
Client-Side Verifiers
Local applications, browser extensions, mobile apps, or operating system utilities that run directly on an end-user's device. Operating independently of the distributing platform, these utilities perform structural and signature checks by extracting the manifest container directly from the file binary. The utility recalculates the asset's cryptographic hash and compares it to the signed hash within the manifest against a certificate trust list, verifying file integrity.
| Application | Developer | Implementation | License | C2PA Conformance Program |
|---|---|---|---|---|
| Adobe Content Authenticity Inspect (Web application) | Adobe Inc. | 2020-10 | Proprietary | 2.2 |
| C2PA Tool (Command-line interface) | Adobe Inc. | 2022-06 | Single-vendor Open Source Apache 2.0 / MIT License | no |
| Content Authenticity Verify (Web application) | Adobe Inc. | 2025-08 | Single-vendor Open Source Apache 2.0 | no |
| C2PA Verify (Web application) | Adobe Inc. | 2026-01 | Apache 2.0 | no |
Open-source software development kits and libraries
Adobe and Content Authenticity Initiative
- CAI Rust library: It implements the C2PA and CAWG specifications under the name
c2pa-rs, to meet the development needs of Adobe software applications. Security vulnerabilities are reported and resolved privately through Adobe's Intigriti platform. c2pa-rswrappers: Language-specific software development kits that wrap around the core Rust implementation to provide functionality across various programming environments. These implementations include:- CAI JavaScript library: Integrates C2PA functionality into web applications and Node.js environments using compiled WebAssembly (Wasm) binaries derived from the core
c2pa-rscodebase. - CAI SDK C++ library: Exposes the core Rust functionality to C++ runtimes.
- C2PA Python library: Enables Python applications to read and write provenance manifest data.
- C2PA Swift: Provides native iOS and macOS bindings for Apple ecosystems.
- C2PA Android library: Enables mobile integration for the Android operating system.
- CAI JavaScript library: Integrates C2PA functionality into web applications and Node.js environments using compiled WebAssembly (Wasm) binaries derived from the core
The core library and its wrappers, also known as the Content Credentials SDK, are distributed under the Apache 2.0 License and the MIT License.
TrustNXT
- c2pa-ts: A standalone TypeScript library designed for reading, creating, and partially validating C2PA 2.1 manifests within web and JavaScript ecosystems. The implementation operates natively without relying on WebAssembly or underlying compiled C binaries.
It is licensed under the Apache 2.0 License.
- Credentio: A C++ Library developed by Google to support the extraction, validation, generation, and embedding of Content Credentials into Google products. The project is excluded from the Google Open Source Software vulnerability disclosure program.
It is licensed under the Apache 2.0 License.
Licensing
The C2PA specifications are released as an open technical specification under a royalty-free license.
Content Credentials and its logo are Adobe Inc. trademarks, registered with the US Patent and Trademark Office, European Union Intellectual Property Office, and other international trademark authorities.