How to check an image for C2PA Content Credentials
Five ways to see whether a photo or video carries Content Credentials, who signed them and whether they mark the file as AI, on your device or the command line.
4 min read
On this page9 sections
Short answer. The fastest check is the free AI label checker: drop in a JPEG, PNG, WebP, MP4 or MOV and it reports whether a C2PA manifest is present, who signed it, and whether it marks the file as AI. It runs on your device. For the full manifest, upload the file to the Content Credentials Verify tool. ExifTool and c2patool do the same from the command line.
Why check
Content Credentials decide whether Instagram, Facebook, Threads and TikTok label a post as AI, and they tell anyone who looks which tool made the file. Checking takes seconds and answers three questions: is there a manifest, who signed it, and does it say the content is AI generated. The answers are different for a Gemini image (signed by Google, marked AI), a Photoshop export (signed by Adobe, marked edited) and a Pixel photo (signed by the camera, marked captured).
Method 1: the on-device checker
The AI label checker reads the first and last few megabytes of a file in your browser, where metadata lives, and reports:
- C2PA Content Credentials: present or not, and the signer when it can be read (OpenAI, Google, Adobe and so on).
- AI source type: the IPTC field that marks a file as AI generated or partly AI generated, which Meta also reads.
- AIGC labels written by Chinese generators.
- AI tool names found anywhere in the metadata.
- Camera make and model, or a note that the file has no camera data.
It handles images and video, checks a whole batch at once, and never uploads anything. It does not read SynthID or other pixel watermarks, because those are not metadata.
Method 2: Content Credentials Verify
The Content Authenticity Initiative runs a public Verify page at contentcredentials.org. Upload a file and it shows the full manifest: the signer and certificate, each action, the ingredients the file was made from, and whether the signature is valid against the current pixels. If the credentials were stripped but the file has a known fingerprint, it can sometimes recover a match from a registry.
This is the most complete view and the one to use for a dispute. It requires uploading the file.
Method 3: Google and the platforms
- Google Search and Chrome. "About this image" shows Content Credentials when they exist, including whether AI was used.
- LinkedIn shows a CR icon on images with credentials. Click it for the summary.
- YouTube shows a "how this content was made" note on videos that carry them.
- Instagram, Facebook and TikTok do not expose the manifest, but their AI labels are the visible result of reading it.
Method 4: inside apps
Photoshop and Lightroom have a Content Credentials panel that shows credentials on open files and lets you choose whether to attach them on export. Google Photos on Pixel phones shows "AI info" in the image details for edited photos. Windows Photos and macOS Preview do not show manifests.
Method 5: the command line
ExifTool lists the manifest under the JUMBF group:
exiftool -a -G1 image.jpg | grep -i -E "jumbf|c2pa|digitalsourcetype"c2patool, the C2PA project's own reader, prints the manifest as JSON and validates the signature:
c2patool image.jpgBoth work on video containers as well as images.
Reading the result
| Result | What it means |
|---|---|
| Signed by OpenAI, Google, Adobe Firefly or Microsoft, marked created | An AI generator made the file. Platforms will label it. |
| Signed by Adobe, marked edited | An Adobe app exported it. If generative tools were used, the manifest says so and platforms label it. |
| Signed by a camera maker or Pixel, marked captured | A camera capture. Not an AI label trigger. |
| Signature invalid | The pixels changed after signing, or the manifest was damaged. Platforms treat this as no credentials. |
| No credentials | Nothing to read. This does not mean the image is not AI; most AI images from Midjourney, Stable Diffusion and Flux never had any. |
If you want the credentials gone
How to remove C2PA Content Credentials covers ExifTool, ffmpeg and re-saving. The image remover and video remover rebuild the file so no manifest survives, and write real camera metadata in its place. Run the checker again afterwards to confirm.
FAQ
Can I check a video for C2PA?
Yes. MP4 and MOV files store the manifest in a uuid box. The on-device checker, Verify, ExifTool and c2patool all read it.
Does "no Content Credentials" mean the image is real?
No. It means no tool signed it. Most AI images from open models carry no manifest, and any manifest can be stripped. Absence proves nothing either way.
Why does a real photo show Content Credentials?
Pixel 10 phones, Samsung Galaxy AI, and cameras such as the Leica M11-P and recent Sony and Nikon bodies sign their files to prove capture. That is provenance, not an AI mark.
Can a C2PA checker detect SynthID?
No. SynthID is a watermark in the pixels. Google's SynthID Detector reads it; metadata tools cannot. How to detect AI watermarks covers both.
Is the on-device checker free?
Yes, unlimited and without an account. Removing what it finds uses the free removal or credits.