Remove C2PA Content Credentials: What They Reveal

Content Credentials are the public name for C2PA, a standard from the Coalition for Content Provenance and Authenticity. The idea is simple: attach a tamper-evident record to a media file that says where it came from and what happened to it.

What's inside a manifest

A C2PA manifest is a signed package stored inside the image file: an APP11 segment in JPEGs, a caBX chunk in PNGs, a chunk in WebP. It typically holds:

• A claim generator: the software or service that produced the claim.
• Actions: created, edited, converted, with timestamps.
• A digital source type, such as 'trainedAlgorithmicMedia' for AI output.
• The software agent involved, sometimes with a model version.
• A cryptographic signature and certificate chain, so edits to the manifest can be detected.
• Sometimes a thumbnail of the image and references to earlier ingredients.

Why they exist

Provenance helps newsrooms, platforms and viewers tell a camera photo from a synthetic image, and it gives creators a way to attach verified authorship to their work. That's genuinely useful, and some publishers and clients now request it.

Why people remove them

• They reveal your tool stack and account usage to anyone, including competitors.
• They timestamp your work, which some designers don't want to share with clients.
• They add 20–30 KB per image, which adds up on image-heavy pages.
• A manifest from an intermediate step can describe a workflow you've since replaced.

A sensible approach

Keep an original with credentials intact in your archive. Publish a cleaned copy where provenance isn't requested. Where a platform, publication or regulation requires you to disclose AI involvement, disclose it. The metadata was one way of doing that; removing it doesn't remove the obligation.