C2PA stands for Coalition for Content Provenance and Authenticity. It is an open technical standard for embedding cryptographically signed metadata into media files — creating a tamper-evident record of where content came from, what tools were used to create or edit it, and whether AI was involved. AIGeneratedIt verifies C2PA credentials on every image scan. Here is how it works.
The problem C2PA solves
Without a provenance standard, there is no reliable way to answer the question: where did this image come from? EXIF metadata exists but is trivially editable. Reverse image search tells you where an image appeared, not where it originated. C2PA solves this by cryptographically binding provenance data to the file itself, so any tampering — including removing or altering the provenance record — is detectable.
How C2PA works technically
A C2PA credential (called a Content Credential or C2PA Manifest) is a JSON-LD data structure embedded in the file's metadata. The manifest contains assertions about the content — who created it, when, with what tool, and whether AI was used — plus a cryptographic hash of the file content at the time of signing. The manifest is signed with an X.509 certificate issued by a trusted Certificate Authority in the C2PA trust list.
When AIGeneratedIt verifies a C2PA credential, it performs three checks: (1) the certificate signature is valid and issued by a trusted CA, (2) the file content hash matches the hash in the manifest (confirming the file has not been altered since signing), and (3) the assertions are consistent (e.g. if the manifest claims human authorship but the creation tool is listed as Midjourney, this is flagged).
Which tools currently support C2PA
As of 2026, C2PA credentials are issued by Adobe (Photoshop, Lightroom, Firefly), Microsoft (Bing Image Creator), Leica (M11-P camera), Nikon (Z6 III), Canon (EOS R1), and major social platforms including LinkedIn. The standard is being adopted rapidly as regulators in the EU and US push for mandatory AI content labeling.
C2PA limitations
C2PA is not a complete solution to synthetic media verification. It requires that content creators and platforms adopt the standard — content created without C2PA has no credential to verify. Screenshots, re-uploads, and format conversions typically strip C2PA metadata. And the standard only verifies provenance, not authenticity — a C2PA credential can legitimately state that an image was AI-generated, which is disclosure rather than detection.
This is why AIGeneratedIt combines C2PA verification with forensic detection: C2PA is checked when present, but the forensic models run regardless, providing a detection verdict even for content with no provenance record.