What are Content Credentials and how do you check them on an image?

What a Content Credential actually is

The C2PA explainer calls a Content Credential the non-technical name for a C2PA manifest: a set of statements (assertions) about an asset that are digitally signed. The statements can cover when and where the asset was made, what edits were applied with which tools, and whether AI was involved. When an action was performed by an AI system, the manifest marks it through a digitalSourceType field, so a generated image can say so in a machine-readable way.

Two properties matter for reading one. First, the record is tamper-evident: it uses cryptographic hashes and a signature, so changing the pixels or the record without re-signing breaks the match. Second, the standard makes no value judgment. In the explainer's words, provenance information alone cannot tell you whether content is "true, accurate or factual". A valid credential tells you who signed a claim and that the file still matches it. It does not tell you the claim is honest.

How to check one, step by step

1. Get the original file. A screenshot, a chat-app copy or a social platform's re-encoded version often has no credential left to read. Ask the sender for the file they exported, or download it from the source page.
2. Upload it to a verifier. Adobe's Inspect tool works like this: open Adobe Content Authenticity, choose the Inspect tab, then Browse files. Adobe states that content uploaded to inspect is not stored anywhere. The public Content Credentials verify page forwards to a verifier from the same ecosystem. Google's Gemini app can also read credentials: its verification help page says to upload a single image and ask whether it was created or edited by AI.
3. Read the summary. Look at the signer name, the edit history and whether AI tools are listed. Gemini's help says it can show media composition, edit history and whether or not AI was used.
4. Note the errors. A failed check is information, not a verdict. Gemini lists three causes: the history was modified without a proper update of the C2PA data, the credential comes from a product outside the C2PA conforming products list, or the file contains malformed credentials.
5. In a browser, look for the icon. Adobe's Content Credentials overview describes a Cr icon you can hover on an image, and a Chrome extension that shows credentials on websites.

What each result means

What you see	What it can mean	What it does not mean
Valid credential, known signer, AI listed	The signer states the image was generated or edited with AI	That the scene depicted is real or unreal
Valid credential, camera or editing app, no AI listed	The signer's tool recorded a capture or edit history	That nothing outside the recorded steps happened
Credential present but invalid	The file or record changed after signing, or the signer is not recognised	That the image is fake
No credential found	Nothing was attached, or it was stripped, or the tool cannot read it	That the image is AI, or that it is genuine

The last row trips people up. The explainer's FAQ asks whether you should distrust media without Content Credentials and answers "Maybe", adding that the specification does not intend a two-tier world where uncredentialed media is automatically less trusted.

Why credentials go missing

The explainer is plain about it: provenance metadata can be removed. Many upload pipelines re-encode images and drop embedded data, and a crop in an app that does not support C2PA may leave the record out of date. If the file is later opened in a supporting app, the new signer implicitly attests to the earlier edit, so a gap in history is possible without a broken signature.

To address removal, the specification describes durable credentials: a hard binding (the hash) plus a soft binding such as an invisible watermark or a fingerprint lookup, which can help find the manifest again when it is no longer embedded. Adobe's Lightroom help describes the practical version, publishing credentials to a cloud service so they stay recoverable. Gemini's help adds a caveat: it does not support credentials stored remotely, separate from the file.

For a worked case of credentials vanishing after an export, see the Lightroom export thread. For what to do when there is nothing to read at all, start with the guide to checking whether an image is AI generated.

A short checklist

• Check the original, not a copy.
• Treat "valid and signed by a name you recognise" as strong evidence about origin, and nothing more.
• Treat "no credential" as unknown, then use other checks: reverse image search, the source account, the photographer's other files.
• Keep your own exports and working files so you can show your process if asked.