Can Markdown or source code contain a C2PA credential?
Yes. C2PA 2.4 defines an ASCII-armored manifest block for structured text formats with comments or front matter, including Markdown, YAML, TOML, source code, configuration files, AsciiDoc and LaTeX.
Paste the text into the checker. It recognizes exact C2PA manifest delimiters, distinguishes an external URI from an embedded Base64 manifest store, and removes only blocks whose host context is safe to delete as a whole.
The two C2PA structured-text forms
| Form | Where it appears | Supported cleanup |
|---|---|---|
| Single-line comment | A complete manifest reference between fixed delimiters on one comment line, such as #, //, /* */, or <!-- -->. | The entire recognized comment line is removed, including its trailing line ending when present. |
| Front matter | BEGIN delimiter, one reference line, and END delimiter inside recognized --- or +++ front matter. | Only the three manifest lines are removed; the host front-matter delimiters and other fields remain. |
What the manifest reference contains
The value between the delimiters is either an absolute URI to a C2PA manifest store or a data:application/c2pa;base64,… URI containing the manifest bytes. Embedded Base64 is decoded locally under a fixed size limit. External URIs are classified and hashed for the evidence report but never requested.
Why cleanup is deliberately conservative
The standard permits format-agnostic discovery, but automatic deletion must understand enough host context to avoid damaging content. This implementation recognizes whole-line comment pairs and bounded YAML or TOML front matter. If the delimiters appear inside ordinary prose, an unknown comment style, an incomplete block, or an invalid reference, the block is shown and retained.
What validation is not performed
A valid C2PA structured-text claim also contains a c2pa.hash.data assertion whose exclusion range exactly covers the manifest block in the original binary text. Full validation may require fetching an external store, parsing its claims, verifying its signature and trust, and checking exact LF or CRLF byte offsets. This release reports structural detection only and does not make those network or cryptographic claims.
Which formats are outside this method?
C2PA says format-specific embedding should take precedence. HTML and SVG have their own embedding methods. Binary files and text formats without comments or front matter—CSV is the standard's example—are not candidates for this structured-text form.
Structured versus invisible C2PA text
The structured block is human-readable and designed for comments or front matter. The separate unstructured-text method encodes the entire manifest store into invisible Unicode variation selectors after C2PATXT\0. The checker reports them as different credential types.
Primary source
- C2PA 2.4: Embedding manifests into structured text
- Versioned scanner and cleanup methodology
- AI text watermark checker coverage
Frequently asked questions
Can Markdown contain a C2PA Content Credential?
Yes. C2PA 2.4 defines a structured-text manifest block. Markdown can carry it in an HTML comment or inside front matter using fixed BEGIN C2PA MANIFEST and END C2PA MANIFEST delimiters.
Does the checker open an external C2PA manifest URL?
No. It recognizes and fingerprints the reference locally but never fetches an external URL. This avoids leaking the document or reference to another server and prevents untrusted network requests.
Can a structured C2PA block be removed without changing the document?
The checker removes only an exact whole comment line or an exact three-line block inside recognized YAML or TOML front matter. Ambiguous, malformed, and unsupported contexts are preserved for review.
Is detecting the manifest block the same as validating its signature?
No. Structural detection proves that the delimiters and reference follow the supported C2PA text format. This browser release does not validate the structured text hard binding, external manifest, signature, or trust chain.