September 7, 2026 · 6 min read

What Are Content Credentials (C2PA)? A Plain-English Explainer

Content Credentials are the invisible 'nutrition label' now attached to photos by AI tools and cameras. Here's what C2PA records, who can read it, and how to check or remove it.

If you've seen an 'AI info' label on a social post, or heard that cameras are starting to sign their photos, you've run into C2PA — the standard behind Content Credentials. It's quietly becoming one of the most consequential things attached to your image files. Here's what it actually is.

What C2PA is

C2PA (Coalition for Content Provenance and Authenticity) is an open standard for recording where a piece of media came from and what happened to it. Software that supports it embeds a cryptographically signed record inside the file — a provenance trail. Content Credentials is the consumer-facing name for that record.

What it can record

• Whether the content was generated by AI, and by which tool.
• Which editing software touched it, and sometimes what kind of edits were made.
• The capture device, for cameras that support signing.
• Timestamps and a chain of edits, each signed so tampering is detectable.

Why it matters to you

Platforms read these credentials and act on them. This is why photographers have found real photographs labelled as AI: one AI-assisted edit — a generative fill, an AI denoise pass — writes a credential, and the platform's label doesn't distinguish between 'made by AI' and 'a real photo where AI removed a power line'. The label is applied automatically, and there's usually no appeal button.

How to check what an image carries

You can inspect any image for these markers. Skrubly's AI Image Checker reads a file's C2PA credentials and generator tags and tells you what's embedded — useful both for verifying an image you were sent and for checking your own work before you publish it.

Can you remove it?

Yes — the credential lives in the file's metadata, so re-encoding or stripping metadata removes it. That's the standard fix when a genuine photograph gets mislabelled because of routine retouching, and it's the same operation as removing EXIF or GPS data.

The honest caveat

Because credentials can be stripped, their absence proves nothing — an image with no markers may still be AI-generated. C2PA is good evidence when it's present and silent when it isn't. And if something genuinely is AI-generated, disclosure rules still apply regardless of what's in the file.