C2PA Checker: Content Credentials Viewer

Upload an image or video and we will show its C2PA manifest if there is one: which app wrote it, whose certificate signed it, which actions it declares (created by AI, edited), plus XMP DigitalSourceType and EXIF Software.

Manifest and signer

Claim generator, organization and issuer from the X.509 certificate, signature algorithm, TSA timestamp, manifest history and ingredients.

Created or edited by AI

c2pa.created / c2pa.edited actions with digitalSourceType: trainedAlgorithmicMedia, compositeWithTrainedAlgorithmicMedia and other IPTC codes.

Full signature validation

File integrity and certificate trust are validated by the official service contentcredentials.org/verify.

C2PA Checker and Content Credentials Viewer

C2PA (Content Credentials) is an open standard that lets cameras, editors and AI generators write a signed manifest into a file: what made it and what was done to it. The tool finds the manifest in JPEG, PNG, WebP, AVIF/HEIC and MP4/MOV, parses it and shows the signer from the certificate, the app, the actions and the source type (for example trainedAlgorithmicMedia, meaning generative AI), plus XMP and EXIF. The signature is not verified cryptographically — a link to the official verification service is provided for that.

Finds the C2PA (JUMBF) manifest in JPEG, PNG, WebP, AVIF/HEIC, MP4/MOV and other containers

Signer and issuer from the X.509 certificate, signature algorithm, TSA timestamp

c2pa.actions (created, edited, converted…) with software agent and digitalSourceType

Manifest history and ingredients — which files the result was built from

XMP (DigitalSourceType, CreatorTool, Credit), EXIF (Software, Make, Model), PNG text, MP4 tags

Free, no sign-up: images up to 25 MB, video up to 80 MB; the file is not stored

How to Use

Upload the original image or video — click the box or drag the file in
Click “Check C2PA” and wait for the report
Review the signer, actions and source type; validate the signature at contentcredentials.org/verify

FAQ

It is the public name of the C2PA standard: a signed set of provenance information stored inside the file. It is added by, for example, ChatGPT, Adobe Firefly and Photoshop, Google Pixel phones and some Leica and Sony cameras. Services often show it with a “CR” icon.

No. We show what the manifest contains and the certificate details, but we do not check the cryptographic signature, the content hash or the trust list. For full validation upload the file to contentcredentials.org/verify or use c2patool.

No. Metadata is lost on screenshots, re-saving and uploads to most social networks and messengers, and many generators never write it. A missing manifest means missing information, not proof.

No. The file is parsed in a temporary upload folder that PHP clears right after the response; no copy stays on the server.

How to use this C2PA checker and read the report

To check C2PA, upload the original file — the one you got from the generator, camera or editor, not a copy forwarded through a messenger. The tool looks for a JUMBF manifest store in the usual places of the container and parses it. The report opens with four cards:

C2PA / Content Credentials — whether a manifest was found, how many are in the chain and where it sits (for example “JPEG APP11” or “PNG caBX”). “Traces found, not parsed” means the file contains C2PA markers but the store is truncated or damaged, which happens after careless re-saving.
AI declared — whether the manifest actions or XMP carry a source type code that means generative AI.
Signed by — the organization from the certificate that signed the active manifest, plus the app that wrote it.
Cryptographic check — always “not performed”: we show what is claimed, not what is verified.

Claim generator vs signer

The claim generator is the software that assembled the manifest (for example “ChatGPT” or “Adobe Photoshop”). The signer is the owner of the X.509 certificate used to sign it. Usually they are the same company, but not always: a service may sign with a certificate issued to it through a partner. If the signer field is empty while the manifest was parsed, the certificate was not found in the signature or is stored in a non-standard way — a good reason to run the file through the official validator.

Active manifest and history

Each time a file passes through a compatible app, a new manifest is appended to the store and the previous one becomes an ingredient. The last manifest is the active one: it describes the current version of the file. Older manifests appear in the collapsed “History” block, where you can see, for example, that an image was generated in one service and later cropped in another.

Ingredients, AI training permissions and the timestamp

Ingredients are the files the result was built from: the source that was edited, a placed element, a background. Each may have a title, a format and a relationship: parentOf is the file that was opened and changed, componentOf is a placed part, inputTo is material fed into a generator. The “AI training / mining permissions” row shows a c2pa.training-mining or cawg.training-mining assertion, where the author states whether the file may be used to train models (allowed, notAllowed, constrained). It is a statement, not a technical protection. The TSA timestamp is the time a trusted time server attached at signing; we show it as recorded, without verifying it. Without such a timestamp the signing date is not backed by anything.

Typical results

What the report shows	What it usually means
One manifest, `c2pa.created` + `trainedAlgorithmicMedia`, signed by an AI service	The file was exported from a generator and has not been rebuilt since
Several manifests, the latest actions are `opened`, `edited` in an editor	A generated image was worked on afterwards; the start of the chain is in “History”
Only XMP DigitalSourceType, no C2PA	A generator or editor labelled the file but did not sign it
Nothing at all	Metadata was removed or never existed

digitalSourceType codes explained

The digitalSourceType field of a c2pa.created or c2pa.edited action takes its values from the IPTC vocabulary. The common ones:

Code	Meaning	How to read it
`trainedAlgorithmicMedia`	Created by a trained model	Fully AI-generated (text-to-image, prompt-to-video)
`compositeWithTrainedAlgorithmicMedia`	Composite with AI elements	Photo with generative fill or a replaced background
`algorithmicMedia`	Algorithmic, no training	Procedural graphics, fractals
`digitalCapture`	Captured by a camera	Original from a camera or phone
`computationalCapture`	Computational capture	Phone photo with HDR, night mode and similar processing
`digitalArt`	Digital art by a person	Illustration drawn in an editor
`screenCapture`	Screen capture	Screenshot

The same code can also appear outside C2PA, in the XMP field Iptc4xmpExt:DigitalSourceType. Generators that do not sign files write it, and so do editors on export. That record is unsigned and any metadata editor can change it, so it carries less weight than an action inside a signed manifest.

How to check if an image has C2PA: where the manifest lives

The manifest is stored inside the file, and each format has its own slot for it. That is why the same picture “loses” its Content Credentials after conversion: the new file is built without that block.

Format	Where C2PA is stored
JPEG	APP11 segments (JUMBF); a large manifest is split across several segments
PNG	`caBX` chunk
WebP	RIFF `C2PA` chunk
MP4, MOV, AVIF, HEIC	Top-level `uuid` box with the C2PA identifier

A manifest can also be stored remotely, in the service’s cloud, with only a reference or an invisible watermark left in the file to recover it. This tool does not fetch remote manifests; the official verification service can show them.

Why C2PA disappears

A screenshot creates a new file with no metadata.
Most messengers and many social networks recompress images and drop auxiliary blocks.
Website image optimizers often strip everything except pixels to save bytes.
Format conversion (PNG → JPEG, MOV → MP4) rebuilds the container.

So “manifest not found” is a neutral result. To find out whether an image was made with AI when the metadata is gone, look at the generators’ own invisible watermarks: for Google that is SynthID, for others the tools published by their makers.

Content Credentials verify: full signature validation

Our report answers “what is claimed”. Whether you can trust it is decided by a validator that checks three things: the cryptographic signature of the manifest, whether the hash still matches the file content (no pixels changed after signing), and whether the signer’s certificate is on a trust list. To do that:

Open contentcredentials.org/verify and drop the file in. It shows the edit chain, the signer and warnings when the signature or hash does not match.
For batch checks, install the open-source command-line tool c2patool from the Content Authenticity Initiative and run c2patool image.jpg: it prints the manifest store as JSON together with validation statuses.
If the validator reports a hash mismatch, the file was modified after signing. The manifest itself can still look plausible, which is exactly why we do not call our parsing an authenticity check.

C2PA on your own website

If you publish AI-generated images and want the provenance label to survive, test the whole path of the file to the page: export from the generator, processing in your CMS, conversion to WebP or AVIF, the CDN. After each step, upload the resulting file here and you will quickly see where the manifest gets lost. If you need the opposite — removing auxiliary data such as GPS location from photos — use the EXIF and metadata remover: it wipes C2PA too, but does not remove watermarks embedded in the pixels. For other traces that generators leave in files, see the article on hidden watermarks and the image watermark detector.