C2PA Content Credentials: what they prove, what strips them, and how to check

C2PA Content Credentials are signed metadata that travels with a file and says what made it and how it was edited. They are now the default way AI image, video and writing tools mark their output, and they are evidence rather than proof: the signature covers only the bytes the signer chose to cover.

By the end of this post you will know what a credential actually asserts, what removes it, how it differs from an invisible watermark such as Google's SynthID, what the EU AI Act has required of providers since August 2026, and how to test a tool's output yourself in about ten minutes. If you are picking from the 219 AI image and video tools we list (as of October 2026) in AI Image & Video, this is the part of the spec sheet we think gets checked least often.

What C2PA Content Credentials actually are

A Content Credential is a C2PA manifest attached to a file. Inside it are assertions - statements about who created the asset, which tool or model was involved, and what actions were applied - plus a claim signature over those assertions, usually with a timestamp from a trusted timestamping authority.

The piece that ties the manifest to the pixels is called a hard binding. In the C2PA technical specification, version 2.3 (dated December 2025), a data hash assertion is used "to define the range of bytes that are hashed (and those that are not)", and the spec says a hard binding "can exclude parts of an asset, for various reasons". Those exclusions are normal and necessary: the manifest itself cannot be inside its own hash.

So a credential answers a narrow question well - has this specific run of bytes changed since a particular key signed it - and says nothing at all about the bytes outside that range.

A Content Credential only covers the bytes the signer chose

On 2 October 2026 the security researcher David Buchanan published a demonstration of what that gap allows. In How to Hack Time, With C2PA he set a single exclusion range to cover the whole file, so the signed hash was the SHA-256 of an empty string. As he puts it: "We can exclude the entire file, to produce an entirely valid signature over an empty string."

The file can then be edited afterwards "without invalidating the signature, and without invalidating the TSA's timestamp proof". His worked example is a photo of a lottery ticket whose credential says it existed before the draw; he says plainly that the image is photoshopped and that he is not attempting fraud. Buchanan also reports that "as of today all the C2PA verification tools I can find don't flag anything as unusual", and that the problem cannot be fixed easily, proposing instead that each file format specify which parts may be excluded and that verifiers enforce those rules.

This is not an isolated finding. An independent security analysis, Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short (arXiv, 27 April 2026), concludes that the current specifications do not meet their claimed security goals and that C2PA "should not yet be relied upon for high-stakes uses such as financial disclosures, journalism, or legal evidence".

In our view that is the right altitude for a buying decision too. Treat a Content Credential as a useful disclosure channel and a weak authenticity claim. If the question is whether a file is AI-generated, a credential that is present and consistent is good evidence; a credential that is absent, or one whose hard binding covers almost nothing, tells you nothing either way.

What strips content credentials from a file

A credential lives in the file's metadata, which means anything that rewrites the file without carrying the manifest store across drops it. The specification itself concedes the gap: "In some cases, it may not be possible (or practical) to embed a C2PA Manifest Store in an asset", and it defines a manifest repository for storing manifests outside the file, plus a separate soft binding mechanism for re-associating content with a manifest.

That is why the honest answer to "do content credentials survive uploading to social media" is: test it, per platform, per format, with your own files. Export paths, resizing steps, format conversions and CDN transforms all sit between your generator and your audience, and we would not assume any of them preserves a manifest just because the generator wrote one.

Is C2PA the same as a watermark? No, and you want both

Metadata credentials and invisible watermarks fail in different ways, which is why the Commission's Code and both vendors we checked below reach for more than one layer.

Google's SynthID is the best-documented example of the second row. Google says the watermark is added at creation across its generative products, covering images, video, audio and text, and that for images and video it is "designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression". For text, Google says SynthID works by adjusting word-probability scores during generation. The SynthID Detector portal, which Google says launched in 2025 and is now open to everyone, checks whether a file was made with AI from Google or its partners; the page names OpenAI, NVIDIA and Kakao as partners, with Apple listed as coming.

Anthropic documents a two-layer approach for Claude, which we list in AI Assistants: per its support page on how Claude marks AI-generated content, generated text carries an embedded watermark and generated files such as PNG and JPEG carry C2PA Content Credentials where supported, worldwide, with models launched in the EU on or after 2 August 2026 marking at launch. The detail worth noting before you depend on it: Anthropic says watermark detection is in private preview for eligible organizations, while the free Claude Content Checker only verifies Claude-issued Content Credentials in files.

That asymmetry matters. In our view a watermark you cannot test is a compliance artifact for the vendor rather than a verification tool for you.

The third row is a different trade. Classifiers such as Hive AI, listed in APIs & Integrations, work on unmarked files: its product page says its APIs scan images, video and audio for AI and return confidence scores, with the image and music models also naming a likely generative engine. Those are the vendor's own claims, it publishes no API pricing and directs buyers to sales, and a confidence score is not provenance. We would use a classifier for moderation triage, not to settle a dispute.

Do I need to mark AI-generated content in the EU?

If you ship a product that generates synthetic media, probably yes. Under Article 50 of the EU AI Act, providers of AI systems "generating synthetic audio, image, video or text content" must ensure outputs "are marked in a machine-readable format" and "detectable as artificially generated or manipulated". The page records that Article 50 comes into force on 2 August 2026 under Article 113, so this is a live obligation rather than a future one.

There are carve-outs in the same paragraph: systems that "perform an assistive function for standard editing" or that "do not substantially alter the input data", and uses authorised by law to detect, prevent, investigate or prosecute criminal offences. A grammar checker is a very different proposition from a text-to-video model, and an AI writing tool that rewrites a sentence you typed sits somewhere in between - which is a question for your counsel, not for a directory.

Deployers have their own duty: Article 50(4) requires disclosure for image, audio or video content that constitutes a deep fake, with the obligation limited to disclosing existence where the work is evidently artistic, creative, satirical or fictional.

The practical guidance sits in the Commission's Code of Practice on marking and labelling AI-generated content, published on 10 June 2026. Jones Day's note on the final Code reports that the Code is voluntary but likely to become an important reference point, that it asks signatories to use "at least two layers of machine-readable marking where necessary", and that providers should offer detection mechanisms so others can verify whether content was AI-generated. Two layers is also the shape of what Google and Anthropic already ship, which we read as a signal of where the floor is settling.

How to check content credentials on an image yourself

You do not need a vendor's word for any of this. The Content Authenticity project maintains c2patool, a command line tool for displaying and adding C2PA manifests, dual-licensed Apache-2.0 and MIT, installable on macOS with brew install c2patool.

1. Generate a sample with the tool you are evaluating, on the plan you would actually buy - free tiers and paid tiers do not always behave the same, so check both if it matters.
2. Run c2patool against the file and read the detailed report, not just the summary. Confirm a manifest exists and is signed by whom you expect.
3. Look at the hard binding's exclusion ranges. If they cover a large share of the file, the signature is proving far less than it appears to, which is the gap Buchanan demonstrated.
4. Push the file through your real publishing path - export, resize, format conversion, CDN, the platform you post to - then re-run c2patool and see what survived.
5. Ask the vendor, in writing, whether outputs also carry an invisible watermark, and whether there is a detector you or a third party can use. Note the answer; our view is that a watermark with no accessible detector should not be treated as verification.

What to ask before you standardize on a creative AI tool

For teams comparing the tools in AI Image & Video - among them Midjourney, RunwayML, KLING AI and Freepik - and the 121 tools in AI Writing (both counts as of October 2026), we think marking now belongs in the procurement questions alongside pricing and licensing. We would put four items on the list: whether outputs carry a C2PA manifest, whether they also carry a watermark, whether a detector exists that you can run, and what the vendor's exclusion ranges look like in practice.

None of that replaces reading the terms. Marking tells your audience a file is synthetic; it says nothing about whether you may use the file commercially, which is a separate clause in a separate document.

The next step is cheap: pick the one generator your team actually publishes from, run its output through the five checks above today, and write down what survived your pipeline. Then compare that against the alternatives in AI Image & Video - our earlier look at what Canva's first image model is good for is a worked example of judging a new generator on specifics rather than launch copy. If you build one of these tools and marking is something you have solved properly, list it on Upfynd and say so on the listing; in our view it is a selling point that is about to stop being optional.