TL;DR
- Get the original file (not a screenshot or re-saved copy)
- Go to c2paviewer.com or verify.contentauthenticity.org
- Upload the file — all processing is in-browser, no server uploads
- Check the validation status: valid, no data, or invalid
- Review the author, software used, AI indicators, and edit history
What Does It Mean to Verify Content Credentials?
Verifying C2PA content credentials means checking the cryptographic signature embedded in a file's C2PA manifest. A valid verification result confirms two things: the manifest has not been altered since it was signed, and the signing entity is who they claim to be (verified through an X.509 certificate chain). The C2PA Technical Specification 2.2 (published May 2025) governs the verification process.
When you verify content credentials, the tool inspects the embedded C2PA manifest data and reports on:
- The content's creation source and origin
- Every edit or modification recorded since first signing
- The identity of the creator or organization (from the signing certificate)
- Whether AI tools were declared as part of the creation process
- The full chain of custody for the digital asset
Important distinction: C2PA verification confirms the manifest's integrity — not the truth of the content itself. A video could contain misleading footage and still carry a valid C2PA signature if it was not altered after being signed. Treat C2PA as a provenance signal, not an absolute truth indicator.
C2PA Verification Tools: Which One to Use
Three categories of tools can verify C2PA content credentials. Each suits a different workflow and level of technical depth.
| Tool | Type | Raw Manifest | No Upload | Best For |
|---|---|---|---|---|
| C2PA Viewer (c2paviewer.com) | Browser | Yes | Yes | Technical users, developers, journalists |
| verify.contentauthenticity.org | Browser | No | Yes | General consumers, visual summaries |
| C2PA Browser Extension (Chrome, Edge) | Extension | No | Yes | Passive monitoring while browsing |
| c2patool (CLI) | Command-line | Yes | Yes (local) | Batch processing, automation, CI/CD |
How to Verify Content Credentials: 6-Step Process
Follow these steps to verify C2PA content credentials using the free C2PA Viewer tool. The process takes under three minutes for most files.
Step 1: Obtain the Original File
Use the original file directly — not a screenshot, not a re-saved copy, and not a version that has passed through messaging apps like WhatsApp or iMessage. These platforms re-encode images and strip C2PA manifests in the process. Download the original from the creator's source or use the file exported directly from a C2PA-enabled device.
Step 2: Open the Verification Tool
Navigate to c2paviewer.com. No account or installation is required. The tool works in any modern browser — Chrome 90+, Firefox 90+, Safari 15+, Edge 90+.
Step 3: Upload the File
Click Browse Files or drag and drop your file onto the upload zone. Supported formats: JPEG, PNG, WebP, TIFF, MP4, MOV. The tool starts processing immediately. All analysis runs in-browser using the c2pa-js WebAssembly library — your file is never sent to any server.
Step 4: Check the Validation Status
The first result to check is the validation status indicator:
- Valid signature — the C2PA manifest is cryptographically intact and has not been tampered with since signing
- No C2PA data — no manifest is present; provenance cannot be verified
- Invalid / corrupted — a manifest exists but the signature check fails; treat provenance as unconfirmed
Step 5: Review the Provenance Details
If the signature is valid, review the structured provenance data:
- Author / Signer — the organization or entity named in the signing certificate (e.g., "Sony Corporation", "Adobe Inc.", "Google LLC")
- Software used — applications declared in the manifest (Adobe Photoshop, Lightroom, Firefly, etc.)
- AI generation — whether AI tools were declared as part of creation
- Action history — every recorded edit from creation to the current state, with timestamps
Step 6: Inspect the Raw Manifest (Optional)
Expand the Raw Manifest section to view the complete JSON. This reveals assertion-level data not shown in the summary view — including c2pa.training-mining consent flags, JUMBF hashes, and the full certificate chain details. This level of detail is only available in C2PA Viewer, not in the official Content Credentials tool.
Understanding Your Verification Results
When you verify content credentials, the viewer presents several key result types. Here is how to interpret each one:
Valid Signature
The C2PA manifest's cryptographic signature is intact. The manifest has not been altered since it was signed. This is the strongest provenance indicator — it confirms who signed the content and that the manifest data is authentic.
Author / Signer Identity
The name extracted from the X.509 signing certificate. This is the entity that applied the C2PA signature — typically a camera maker, AI platform, or news organization. Cross-check this against the C2PA Trust List, launched in mid-2025, to confirm the signer is a recognized C2PA participant.
Software Used
Applications declared in the manifest's software assertion. Common examples: Adobe Photoshop 2025, Adobe Lightroom 8.x, Leica FOTOS, Sony Imaging Edge, Google Photos, Adobe Firefly.
AI Generation Indicator
Declares whether AI tools were used in content creation. The C2PA standard includes a dedicated assertion for this. If AI generation is flagged, the manifest may also include the specific model or service name.
Action History
A chronological timeline of all recorded actions: c2pa.created, c2pa.edited, c2pa.transcoded, and others. Each entry shows the timestamp and the software that performed the action.
Invalid or Corrupted Manifest
The manifest exists but the signature check fails. Possible causes: the file was re-saved by software that does not preserve C2PA integrity, the manifest was manually modified, or an intermediate platform stripped the signature. Content with an invalid manifest should be treated as unverified.
What If No C2PA Data Is Found?
If the verifier reports "No C2PA Data Found," one of the following applies:
- The file does not contain an embedded C2PA manifest — it was not created with C2PA-enabled software
- The file format does not support C2PA metadata embedding
- The C2PA manifest was stripped during editing, sharing, or re-saving by non-C2PA software
- The file was downloaded as a screenshot or thumbnail rather than the original
A "No Data" result does not mean the content is fake — it simply means no signed provenance record is available. Learn more about which cameras and software embed C2PA data on our supported devices page.
Best Practices for C2PA Content Verification
Always use the original file
Screenshots strip C2PA manifests. WhatsApp, iMessage, Facebook, and most social platforms re-encode images and remove manifests. Use the original file from the source.
Check the signer against the C2PA Trust List
The C2PA Trust List (launched mid-2025) lists recognized signers. A valid signature from an unlisted signer is technically valid but carries less weight than one from a known, trusted organization.
Review the full action history
The action history shows every recorded edit. Multiple editing steps are normal, but a gap between the declared creation date and the first signed action may indicate the manifest was applied retroactively.
Do not rely on verification alone
C2PA verification confirms manifest integrity, not content truthfulness. Combine C2PA results with editorial judgment, reverse image search, and other fact-checking tools for a complete assessment.
Verify Content Credentials Now — Free
Use the C2PA Viewer to check digital content authenticity instantly. No account, no uploads, no cost.
Frequently Asked Questions
What does it mean to verify C2PA content credentials?
It means checking the cryptographic signature in a file's C2PA manifest. A valid result confirms the manifest has not been altered since it was signed, and reveals who signed it, what software was used, and the complete edit history.
Does verifying content credentials require uploading my file?
No. Browser-based tools like C2PA Viewer and verify.contentauthenticity.org process files entirely in-browser using WebAssembly. Your file never leaves your device.
What file types can I verify with C2PA?
Browser tools support JPEG, PNG, WebP, TIFF, MP4, and MOV. The command-line tool c2patool additionally supports HEIC, AVIF, PDF, MP3, and WAV. JPEG is the most widely used format in C2PA-enabled devices and AI tools.
What happens if no C2PA data is found?
The file has no embedded C2PA manifest. This is the result for most images online today. It does not mean the content is manipulated — only that no signed provenance record exists for that file.
What is the difference between C2PA Viewer and verify.contentauthenticity.org?
Both verify C2PA credentials in-browser with no file uploads. C2PA Viewer also exposes the complete raw JSON manifest, making it suitable for technical analysis and debugging. verify.contentauthenticity.org shows a polished visual summary but does not provide raw manifest access.
Can a screenshot pass C2PA verification?
No. Screenshots do not preserve the C2PA manifest embedded in the original file. Always use the original file for verification. If you only have a screenshot, no C2PA data is available to verify.
Related Articles
How to Use the C2PA Viewer
Step-by-step guide to every feature of the C2PA Viewer tool.
How to Inspect C2PA Metadata
Deep-dive into raw manifest data with browser tools and c2patool CLI.
What is C2PA?
The fundamentals of the C2PA standard and how it protects digital content.
What is a C2PA Manifest?
Structure and components of C2PA manifests explained in detail.