How to check Content Credentials
- Drop a photo, AI image, video or audio file on the box above, click it to pick a file, or paste a copied image.
- The checker reads the C2PA manifest inside the file and verifies its signature on your device. The first check downloads the reader (about 3 MB) once; your file is never uploaded.
- Read the summary, then scroll for the full edit history, ingredients and AI-training preferences. Use Download manifest JSON if you need the raw data.
How to read the result
- Made with is the app or service that wrote the credentials (the “claim generator”), for example a camera, Photoshop, or an AI image generator.
- Signed by is the organisation named on the signing certificate, and Signed on is the time confirmed by a time-stamping service, if one was used.
- Validation has three outcomes. Valid and trusted: the signature is intact, the content matches what was signed, and the certificate is on the official C2PA Trust List (or the older interim list still used for earlier content). Valid, but the signer is not on a trust list: nothing was altered, but the signer's identity isn't vouched for. Invalid: the file or the credentials changed after signing, so the history may not describe this file.
- What happened to this file lists the recorded actions (created, opened, edited, cropped, converted…). The digital source type is the key AI signal:
trainedAlgorithmicMediameans “created using generative AI”,compositeWithTrainedAlgorithmicMediameans “edited using generative AI” (for example generative fill), anddigitalCapturemeans a camera capture. - Ingredients are the files that went into this one, such as the original photo or a placed image, each with its own thumbnail and credentials when available.
- AI training and data mining shows whether the owner allows the file to be used for training AI models.
What C2PA and Content Credentials are
C2PA (the Coalition for Content Provenance and Authenticity) is an open standard from Adobe, Microsoft, Google, OpenAI, the BBC, Sony and many others. A C2PA manifest is a cryptographically signed record embedded in the file that says who produced it, with which tool and what was done to it. “Content Credentials” is the consumer name for the same thing, often shown as a small “CR” icon. Cameras from Leica, Sony and Nikon, recent Google Pixel and Samsung Galaxy phones, Adobe apps, and AI generators including Adobe Firefly, ChatGPT and Google's Gemini image models can add them.
No credentials does not mean fake
Most images online carry no Content Credentials. Many social networks and messaging apps strip metadata on upload, screenshots never had any, and older software simply doesn't write it. So a missing manifest tells you nothing about whether a picture is real or AI-generated. The reverse is also true: credentials are the signer's own statement. A valid manifest proves who signed the file and that it hasn't changed since, not that the scene is true. When credentials are missing, check the AI image detector for other AI markers and the EXIF viewer for camera data, and search for the original upload.
Why AI labels matter in 2026
Since 2 August 2026, Article 50 of the EU AI Act requires providers of generative AI systems to mark synthetic images, video, audio and text in a machine-readable, detectable way (providers already on the market before then have until 2 December 2026), and people who publish deepfakes must disclose that the content was artificially generated or manipulated. In the United States, California's AI Transparency Act (SB 942, as amended by AB 853) has applied since the same date to generative AI services with more than one million monthly users: they must embed hidden “latent” disclosures such as the provider name, model version and creation time in AI images, video and audio, offer a visible label, and provide a free detection tool. C2PA manifests are the most common way to meet these machine-readable labelling rules, usually alongside invisible watermarks such as SynthID (used by Google and, since May 2026, OpenAI), which live in the pixels and can only be checked with the vendors' own tools.
Troubleshooting
- “Invalid” after editing: editing or re-saving in an app that doesn't support C2PA changes the pixels, so the signed hash no longer matches. Check the original export instead.
- “Credentials stored online”: some files only link to a cloud manifest. This tool doesn't fetch it, to keep your check private.
- HEIC or video preview missing: your browser can't display that format, but the credentials are still read.
Frequently asked questions
What are Content Credentials?
Content Credentials are a signed record, built on the open C2PA standard, that a camera, editing app or AI generator embeds in a file. They say who produced it, with which tool, what was changed, and whether AI was used. Because they are cryptographically signed, any later change to the file or the record can be detected.
The checker says “No Content Credentials found”. Is the image fake?
No. Most images have no credentials, and social networks, messaging apps and screenshots usually remove them. Missing credentials tell you nothing either way. Look for other clues with the AI image detector and EXIF viewer, and try a reverse image search to find the original.
What does “valid, but the signer is not on a trust list” mean?
The credentials are intact and match the file, but the certificate that signed them isn't on the official C2PA Trust List or the older interim list. Test tools, some apps and individuals use such certificates. It doesn't mean the file is fake, only that the signer's identity isn't independently vouched for.
How do Content Credentials show that an image was made with AI?
Look at the actions. A digital source type of trainedAlgorithmicMedia means the content was created with generative AI, and compositeWithTrainedAlgorithmicMedia means generative AI was used to edit part of it, for example with generative fill. The checker highlights both and also flags ingredients made with AI.
Can this tool detect SynthID or other invisible watermarks?
No. SynthID is an invisible watermark inside the pixels that only the vendors' own tools can read: ask the Gemini app whether an image was made with Google AI, or use OpenAI's image verification tool for ChatGPT images. This checker reads the separate C2PA metadata, which Google and OpenAI also add.
Why are the credentials invalid after I edited the photo?
The manifest stores a hash of the image data. Editing or re-saving in an app that doesn't update Content Credentials changes the data, so the hash no longer matches and the result is invalid. Apps that support C2PA add a new manifest that lists the old one as an ingredient instead.
Is my file uploaded anywhere?
No. The C2PA library runs as WebAssembly in your browser and the trust lists are bundled with this site. The tool never fetches remote manifests or contacts certificate servers, so nothing about your file leaves your device.
Which file types can I check?
JPEG, PNG, WebP, AVIF, HEIC/HEIF, TIFF, DNG, GIF, SVG, JPEG XL, MP4, MOV, M4A, MP3, WAV and PDF: the formats the official C2PA library supports. Files up to 1 GB can be read.