What does a Content Credentials check prove?
C2PA Content Credentials are tamper-evident provenance records for media. A checker can inspect the manifest, test whether the asset and claim still match, verify the cryptographic signature, and evaluate the signer against a trust list.
A valid credential shows that its signed claim has not been improperly changed. A trusted credential also chains to a signer accepted by the configured trust list. Neither result independently guarantees that every assertion is true, and absence is not evidence of human authorship.
How this C2PA checker works
- Read. The browser looks for an embedded C2PA manifest in the PNG, JPEG, or WebP file.
- Match. It checks whether the signed claim corresponds to the asset being inspected.
- Verify. It validates the cryptographic signature and reports validation failures rather than converting them into a vague score.
- Evaluate trust. It distinguishes a valid signature from a signer that chains to the current official C2PA trust list.
The app uses the official Content Authenticity Initiative C2PA browser library. Processing happens locally in the browser; the image is not uploaded to our server.
Result meanings
| Result | Meaning | Do not conclude |
|---|---|---|
| Trusted | The credential validates and its signer chains to the configured official trust list. | That every assertion has been independently fact-checked. |
| Valid | The asset and signature validate, but the signer is not reported as trusted by that list. | That the credential is fraudulent. |
| Invalid | One or more integrity or signature checks failed. | Why it failed without reading the validation details. |
| Present | A credential structure was found, but a definitive validation result was not available. | That it is valid or trusted. |
| Absent | No embedded credential was found in the inspected file. | That no external credential exists or the media is human-made. |
Can Content Credentials be removed?
This app can create a cleaned copy without the embedded manifest while preserving render-relevant image data. That does not promise to erase externally discoverable or durable credentials. The original file is untouched, and the app verifies the cleaned copy separately.
Content Credentials versus pixel watermarks
They solve related provenance problems in different layers. A credential is a signed data structure associated with the asset. A pixel watermark is a signal embedded in image content. Removing one does not imply removing the other, which is why the checker reports them separately.
Compare C2PA, SynthID pixels, visible marks, and ordinary image metadata.
Can Content Credentials travel with text?
Yes. C2PA 2.4 defines an unstructured wrapper that encodes a complete manifest store with invisible Unicode variation selectors, plus a structured format for manifest references in comments or front matter. This checker can decode and safely remove supported forms, but its current cryptographic validator only handles supported media formats. Text results therefore distinguish “structure decoded” from signature or hard-binding validation. See the invisible-text rules or structured-text rules.