What are Content Credentials?

What do Content Credentials record?

Content Credentials are the public name for a C2PA manifest. C2PA is the Coalition for Content Provenance and Authenticity, the body that writes the standard, and its explainer describes a credential as a structure bound to a file by cryptography that records the file's provenance, meaning where it came from. The record is made of statements called assertions. In practice you'll see things like these:

• Whether AI was used to generate or edit any part of the content
• The app or device that made it, such as a camera model or an AI tool
• Who issued the credential, and when it was signed
• In some cases, what was done to the file along the way

They aren't only for AI. A camera can sign a photo the moment it's taken, and an editing app can add its own step. So a credential tells you the file's stated history, which may have no AI in it at all.

How the seal works

The tool that made the file computes a fingerprint of it, called a hash, writes the record, and signs the lot with its private key. To check it, a validator recomputes the fingerprint and tests the signature. If any part is tampered with, one or more of those hashes no longer match, which is what tamper-evident means here. It's not that the file can't be changed. It's that a change can't be hidden.

What does the label on LinkedIn mean?

LinkedIn marks an image or video signed with Content Credentials with a C2PA icon. Clicking it shows the credential: whether AI was used, the app or device, who created it, who issued it and when. LinkedIn says it can't yet identify and label all AI-generated content, so a post without the icon tells you nothing either way.

Other platforms read the same signal in their own ways. YouTube says it may apply an AI label automatically to content that contains C2PA metadata. Meta shows “AI info” when it detects industry-standard AI indicators or when people disclose AI content themselves. On any platform, the upload can also remove the credential from the copy people see, so check the original file if the answer matters.

How to check a file

1. 1.

   Get the file itself

   A screenshot or a re-saved copy is a new file with no credential. Use the original download if you can.

2. 2.

   Open a checker

   Our free Verify page needs no account. Drop a file, paste it or browse, or paste a link to the file itself. It works for pictures, videos and audio. The Content Authenticity Initiative runs a public checker too, at contentcredentials.org/verify.

3. 3.

   Read the result

   If the file carries Pleosa's credentials, you'll see when it was made, with which tool and model, how it was marked as AI-generated and its generation ID. Verify never shows who made a file.

4. 4.

   Check the signer as well as the seal

   A valid signature says the record hasn't changed since it was signed. Who signed it is a separate question: see the next section.

What Content Credentials can't tell you

C2PA is plain about this. Its explainer says “provenance information alone cannot tell you whether the digital content is true”. A credential is a claim by whoever signed it, protected from later tampering, and not a verdict.

• No credential proves nothing. Credentials can be removed, and many files online never had one. Their absence doesn't mean a file is real or fake.
• A valid seal isn't the same as a trusted signer. Checkers keep trust lists of known signers, much as a browser keeps a list of certificate authorities. A checker that doesn't know the signer may call it unknown even though the file is intact.
• Removal can be undone only sometimes. The standard's “durable” credentials use an invisible watermark or a fingerprint lookup to find a record again after it has been stripped, where the maker set that up.
• It says nothing about the content's meaning. A true record of how a picture was made doesn't show that the picture is fair or accurate.

Content Credentials or a visible AI label?

You usually want both, because they serve different readers. A visible label speaks to the person watching. A credential speaks to software, and to anyone who goes looking. The law is starting to ask for the first: Article 50 of the EU AI Act requires anyone using AI to make a deep fake to disclose that it's artificial, and platforms have their own rules.

How Pleosa uses them

Files generated in Pleosa carry Content Credentials, where the format allows, and embedded metadata with a unique generation ID, at no extra cost. Anything showing a realistic person also carries a visible “AI-generated” label. General images, ads and reels get the label when an automatic check finds them realistic. Share files as they are: removing labels, metadata or credentials isn't allowed under our terms. Pleosa isn't on the C2PA Trust List yet, so other checkers may show our credentials as from an unknown source. The credentials are still valid, and Verify confirms that Pleosa signed them.