C2PA explained: How Content Credentials prove the origin of digital content and where the standard ends

What is C2PA?

C2PA stands for Coalition for Content Provenance and Authenticity: a standards body hosted by the Linux Foundation that develops the open standard of the same name for digital provenance. Provenance here means what it means in the art world: the documented history of how a work came about and how it was changed.

What the standard produces are Content Credentials: cryptographically signed provenance records embedded in image, video, audio, and document files. They answer three questions that come up with almost every piece of content today. Who created this? Was AI involved? What has changed since? The current specification, version 2.4 (as of August 2026), covers common formats, from JPEG and PNG to MP4 and live streams to MP3, PDF, and Office files.

Two points matter for context. C2PA is not a product and not a vendor. The specification is freely available and anyone can implement it. And adoption is growing: it has by far the broadest industry support of any provenance effort, although it is not yet universally established.

In short, C2PA defines the shared language in which the provenance of a digital media asset is written, carried, and checked.

Who is behind C2PA?

C2PA was founded in 2021 by Adobe, Arm, BBC, Intel, Microsoft, and Truepic and now counts more than 300 member organizations by its own account. Its steering committee today includes Adobe, Amazon, Google, Meta, Microsoft, OpenAI, and Sony. The specification is also going through ISO standardization: it is set to be published as the international standard ISO 22144 ("Authenticity of information: Content credentials"). That would turn an industry specification into a globally recognized standard that public agencies and companies can formally reference in tenders and contracts.

There is a practical reason for that breadth. Provenance records only help if the entire chain plays along: the device that captures the content, the software that edits it, and the platform that distributes it. That is why the consortium brings camera manufacturers together with AI providers, newsrooms, and platform operators. In practice, cameras from several manufacturers already sign photos at the moment of capture, editing tools extend the history, and platforms such as LinkedIn and YouTube display Content Credentials.

Since June 2025, C2PA has also run a conformance program: an independent review of whether a product implements the standard correctly and meets defined security requirements. The public list of conforming products is growing fast: as of August 2026, 167 products from 86 companies have passed, three times as many as in May. The numbers show both serious governance and an ecosystem that is just picking up speed.

Day to day, the trust model pays off at upload. Platforms that support C2PA preserve the embedded provenance records and display them instead of stripping them out. When the signature comes from a vetted issuer on the Trust List, everyone can see it: an image signed by on:mint appears on LinkedIn as "verified by on:mint." That is a real gain in transparency for business and legal use: origin and issuer can be checked right on the platform.

C2PA therefore represents the broadest alliance yet assembled around digital proof of origin.

How does C2PA work?

C2PA attaches a digitally signed provenance document, the manifest, to every file and cryptographically anchors it to the exact file content. In case that anchor is lost along the way, the standard provides watermarks and fingerprints as recovery keys.

The manifest: a sealed list of ingredients

Content Credentials work like a product's list of ingredients, plus a change log. Technically, this document, the manifest, has three building blocks. Assertions are the individual statements: created at this time, with this software, with or without AI. The claim bundles those statements and ties them to the issuer. The claim signature seals the whole thing with a digital signature.

The signature relies on X.509 certificates, the same technology that has been proven for decades behind the padlock icon in your browser and behind PDF signatures. Who counts as a trustworthy issuer is governed by the C2PA Trust List, a public registry of vetted certificate authorities. Verification tools such as verify.contentauthenticity.org distinguish accordingly between "valid" (signature intact) and "trusted" (signature intact and issuer on the Trust List).

Hard binding: anchored to the file content

To keep a manifest from being transplanted from one file to another, the standard anchors it to the content itself. It does so with a hash: a checksum computed from the exact bytes of the file. Change a single bit and the hash changes, which invalidates the signature. This mandatory anchor is called a hard binding. One detail shows how carefully it is designed: the hash excludes the storage area of the manifest itself (the exclusion range), because otherwise embedding the manifest would break its own checksum.

That is both the strength and the breaking point. Tampering always leaves traces. But harmless operations such as automatic recompression during a platform upload also change the bytes and sever the link between file and manifest.

Durable Content Credentials: watermarks and fingerprints

That is exactly what soft bindings are for, two recovery mechanisms defined by the standard. An invisible watermark is embedded into the content itself using steganography, meaning into the pixels or the audio signal rather than the metadata. It carries little data but survives compression and format changes, and it serves as the key to retrieve the matching manifest from a manifest repository, a database of stored provenance documents. One important detail: C2PA does not operate those repositories. They sit with individual services; on:mint, for example, runs its own for its customers' content. The standard only defines the uniform query interface, the Soft Binding Resolution API. The fingerprint requires no change to the file at all: it is computed from the characteristics of the content, much like a music recognition app identifies a song from a few seconds of audio, and it returns near matches that should be reviewed manually.

A Content Credential that stays discoverable through such soft bindings is what the standard calls a Durable Content Credential. C2PA states it plainly: no single technique is sufficient on its own, only their combination makes provenance resilient.

AI labeling: precise and machine readable

For AI content, the standard defines unambiguous signals. The digitalSourceType field classifies content according to a controlled vocabulary from IPTC, the standards body for the news industry, indicating whether a piece of content is fully AI generated, AI modified, or edited by a human. A dedicated assertion, c2pa.ai-disclosure, adds details about the model used and the degree of human oversight. Regions of interest allow AI edits to be pinpointed: a modified image region in pixel coordinates, AI written paragraphs in a PDF, or a replaced audio track between second 68 and 72. Even the recipe of a generation, from the prompt to reference images to model parameters, can be documented as part of the provenance chain.

That gives C2PA what a visible AI label alone cannot deliver: labeling that machines can evaluate automatically and reviewers can verify.

What are the strengths of C2PA?

C2PA makes provenance interoperable, verifiable, and machine readable, built on cryptographic methods that have held up for decades. Four properties carry the standard:

• Openness: the specification is free to implement. The result is one shared language for provenance instead of a separate silo per platform.
• Tamper evidence: any later change invalidates the signature. Provenance can be checked without having to take the sender's word for it.
• Machine readability: platforms, search engines, and AI systems can evaluate provenance automatically. That is precisely what Article 50(2) of the AI Act requires from providers of generative AI systems.
• Governance in practice: the Trust List and the conformance program make trust auditable, and certificates can be revoked. In 2025 that became concrete: after a vulnerability in one camera manufacturer's signing infrastructure, its certificate was withdrawn and the signing feature was suspended for the time being.

Taken together, C2PA shifts the burden of proof: anyone claiming provenance can back it up.

Where are the limits of C2PA?

C2PA proves who signed what and when, not whether the content is true; and the chain only works where every link supports the standard.

No verdict on truth. C2PA says so itself: Content Credentials do not assess whether provenance claims are correct, only whether they are unaltered and signed by a trustworthy issuer. Sign something false and you get a cleanly signed falsehood. The value of a manifest therefore depends on the identity and diligence of whoever issues it.

Metadata is fragile. A screenshot or the recompression during an upload is enough, and the embedded manifest is gone. Soft bindings soften the problem but do not fully solve it: watermarks can be attacked with enough effort, and fingerprints only return near matches.

Missing credentials prove nothing. The standard is designed as opt in. As long as only part of all content carries credentials, their absence is no indication of forgery. When you encounter content without credentials, what you know at first is: nothing.

Broken chains. A single incompatible tool in the editing chain interrupts the history. C2PA acknowledges that provenance is not always complete; uncertified implementations can also be incompatible with one another.

C2PA is not a deepfake detector either, and it does not aim to be. The standard positions itself as a complement to media literacy and fact checking. It supplies the format for dependable provenance; trust, persistence, and completeness have to come from operations.

How does on:mint complement the C2PA standard?

on:mint builds entirely on the C2PA standard and addresses exactly its open flanks: vetted identity, persistence of the record, provable labeling, and verifiability even without credentials. The standard is complemented and refined, never replaced.

Vetted identity. A manifest is only as trustworthy as its issuer. on:mint signs customer content with Trust List backing, after a business verification (KYB) by SSL.com, one of the certificate authorities on the C2PA Trust List. The customer is named as the creator in the record. on:mint attests to it, much like a notary certifying a declaration. On platforms such as LinkedIn, content signed this way appears as "verified by on:mint."

The record travels inside the asset. As a soft binding in the sense of the standard, on:mint uses a steganographic watermark, invisibly embedded in the content itself. If a platform strips the metadata, the key to the documentation stays in the image. That is distinct from the complementary pHash analysis (perceptual hash). It embeds nothing: it computes a perceptual fingerprint of the content and uses it to match circulating copies to the stored original. The documentation itself is anchored by on:mint in an independent, publicly verifiable register (ledger): that keeps it provable that a record existed at a specific point in time in exactly this form.

Labeling you can prove. The AI Act requires two things: providers of generative AI systems (in plain terms, the companies that build them) must mark outputs in a machine readable way (Article 50(2)). Deployers, meaning the companies that use such systems, must visibly disclose deepfakes (Article 50(4)). Anyone can slap on a visible label; it proves nothing, and it can be lost along the way. That is why on:mint documents the act of labeling itself. The fact that labeling took place is written into the Content Credentials in a tamper evident way, including the timestamp. The proof therefore survives even if the visible label is removed later. And enforcement is taking shape: the Wettbewerbszentrale, Germany's self regulatory body for fair competition, runs a dedicated AI complaints office that also covers inadequate labeling of AI content and deepfakes. Anyone who can prove their own act of labeling has the evidence at hand if a complaint arrives. This supports the transparency obligations of the AI Act.

Checking what arrives without credentials. Missing credentials are the standard's blind spot: when you encounter content without provenance, you know nothing at first. on:mint offers two answers here. The browser extension scans content directly while you browse and matches it at any time against the on:mint database via watermark and pHash: if a work is stored there, its origin is documented even when all metadata is gone. A complementary deepfake detection additionally estimates the AI share of the content, providing a supporting indicator where the standard stays silent. on:mint therefore operates the trust and compliance layer that the standard deliberately leaves open.

Conclusion: C2PA makes origin provable, but not on its own

C2PA is the most viable shared language for digital provenance to date: open, cryptographically secured, backed by the largest technology and media companies, and compatible with regulation. But the standard does not decide who deserves trust, it does not survive every platform on its own, and it does not fill itself with vetted identities. That is not a design flaw, it is a division of labor: the specification defines the format, operations create the trust. on:mint takes on exactly those operations, with Trust List backed signatures, a watermark inside the asset, labeling that can be proven, and documentation anchored on an independent, public ledger. The ledger makes the documentation tamper evident and its verification neutral: anyone can check directly against the register at any time that a record exists and is unaltered. The proof therefore stands on its own and stays dependable over time, toward partners, auditors, and in a dispute. That is how a standard becomes lasting proof.