C2PA Content Credentials: what's actually inside, and how to remove them

If Instagram has ever slapped a "Made with AI" label on a photo you actually took, you've met C2PA. It's also the thing behind the little "i" badge on images from Adobe Firefly, Photoshop's Generative Fill, ChatGPT, and a growing number of cameras.

C2PA is described in language that makes it sound permanent: cryptographically signed, tamper-evident, backed by a coalition including Adobe, Microsoft, the BBC, and Sony. All true. And a five-line canvas re-encode still removes it completely.

That isn't a flaw anyone is hiding. It's a direct consequence of the design, and understanding why tells you exactly what the standard can and can't promise.

What C2PA is

C2PA — the Coalition for Content Provenance and Authenticity — is a specification for attaching a signed provenance record to a media file. The record is called a manifest, and a file can carry several, chained together, one per editing step.

A single manifest contains roughly:

• A claim — the core statement about what happened to this asset.
• Assertions — the individual facts. What tool made it, when, what actions were performed (c2pa.created, c2pa.edited, c2pa.placed), who the creator is, sometimes a thumbnail of the asset at that point.
• A claim signature — a cryptographic signature over the claim, made with a certificate belonging to the signer.
• Ingredients — references to the assets that went into this one, each potentially carrying its own manifest.

That last part is why the chains get long. Composite an AI-generated background into a real photo in Photoshop and the result can carry the manifest for the composite, plus the ingredient manifests for both source images.

What that means in practice

The assertions are the interesting part, because they're more detailed than most people expect. Depending on the signer, a manifest may record the specific software and version, a timestamp, the sequence of edit actions performed, the generative model used, an identifier for the creator or their organisation, and low-resolution thumbnails of intermediate states.

That last one deserves emphasis. A manifest can embed a thumbnail of what the image looked like at an earlier editing step. If you cropped someone out, or painted over something, an earlier-state thumbnail may still show it. This is a genuine and under-appreciated disclosure risk, and it's a reason to check what's in a file even when you have no intention of removing anything.

Where it hides, per format

C2PA data is stored in a JUMBF box (ISO/IEC 19566-5), which each container format holds in its own way:

Notice the pattern. In every case the manifest sits in a container slot alongside the pixel data, never inside it. This is the whole story.

Why a re-encode drops it

A JPEG decoder reads the compressed pixel segments and produces a bitmap. It walks straight past APP11. The bitmap in memory is just a grid of numbers — it has no slot for a manifest, because bitmaps don't have metadata.

Encode a new file from that bitmap and there is nothing to copy forward:

const canvas = document.createElement("canvas");
canvas.width = img.naturalWidth;
canvas.height = img.naturalHeight;
canvas.getContext("2d").drawImage(img, 0, 0);
canvas.toBlob(blob => { /* no manifest, no EXIF, no XMP */ }, "image/jpeg", 0.95);

The signature isn't broken or defeated. It's simply not present in the new file, the same way a letter's envelope isn't present once you've copied out the text.

For video the mechanism differs but the logic is identical: remux the container — rewrite the box structure while copying the audio and video streams through untouched — and drop the uuid box on the way. The streams come out bit-for-bit identical, with no quality loss at all, because nothing was re-encoded.

Tamper-evident is not tamper-proof

These get conflated constantly, and the difference is the entire point of the standard.

Tamper-proof would mean the provenance record cannot be removed or altered. C2PA does not claim this and cannot deliver it, because the record travels in a container that anyone can rewrite.

Tamper-evident means that if a manifest is present, you can verify cryptographically whether it's intact and who signed it. Alter one byte of the image and the signature fails validation. That works, and it's genuinely useful.

So C2PA answers "is this signed provenance record authentic?" It does not, and structurally cannot, answer "does this file have a provenance record it ought to have?" A file with no manifest is just a file with no manifest — indistinguishable from a photo taken on a camera that never supported C2PA, a screenshot, or an image that passed through any service that re-encodes uploads.

Which, worth noting, is most of them. Plenty of platforms strip C2PA incidentally through routine re-encoding, with no intent about provenance at all.

Removing it isn't forging anything

Worth stating plainly, because the framing gets muddled.

Removing a manifest deletes a claim. It does not create a false one. There's no C2PA operation for "assert this was shot on a Leica" — the signature would have to come from a certificate you don't hold. Stripping provenance leaves you with an unsigned file that asserts nothing, which is the same state as the overwhelming majority of images on the internet.

The everyday reasons people strip it are mundane:

• You shot a real photo, used Generative Fill to remove a bin from the corner, and Instagram now labels the whole thing "Made with AI".
• You generated an image for personal use and would rather not ship OpenAI's or Adobe's signature inside your file.
• The manifest carries your name, organisation, or software fingerprint and you're publishing anonymously.
• You're reposting your own work and don't want an intermediate editor's chain of ingredient manifests attached.
• An earlier-state thumbnail in the chain shows something you deliberately removed.

Where it would be dishonest is passing generated work off as photojournalism, or as a photograph in a contest that forbids AI. That's a disclosure question and no metadata tool resolves it for you. The file-level signal is one input; what you tell people is the other, and it's the one that matters.

Be honest about what removal doesn't do

If your goal is specifically "no AI label on my post", know that C2PA is one signal among several:

• Pixel-level watermarks. Google's SynthID and similar schemes embed a pattern in the pixels themselves. Re-encoding preserves it within compression tolerance. Metadata removal does not touch it, and there's no reliable client-side removal that doesn't visibly wreck the image.
• Platform-side classifiers. Services run their own detectors over the pixels. They don't need your metadata to make a guess.
• Self-disclosure. If you tick the "AI generated" box on upload, you've told them directly.
• Account and posting signals. Behavioural context you don't control.

So: removing C2PA removes the file-level signal you control. It is not a guarantee about what any platform will decide. Anyone promising otherwise is selling something.

Check before and after

Inspect first — you may find things you didn't expect, particularly ingredient chains and intermediate thumbnails. Drop a file into the content credentials checker to see whether a manifest is present and what it asserts, all locally in your browser.

With the c2patool CLI:

c2patool your_image.jpg

A clean file reports no manifest found. On the exiftool side, the container slots should be gone:

exiftool -a -G1 -JUMBF:all -APP11 your_image_clean.jpg

Then strip with the C2PA remover, and — the step people skip — verify the output rather than trusting the tool. Run the check again on the cleaned file.

The short version

C2PA rides in a container slot next to your pixels, so any operation that rebuilds the file from pixels alone removes it. Signed and tamper-evident means "if present, verifiable" — not "cannot be removed". Before you strip a manifest, read it: the edit history, creator identity, and intermediate thumbnails inside are often more revealing than the AI label everyone's focused on.