What is a C2PA manifest?
A signed block of metadata attached to a media file, recording provenance: which tool produced it, when, and what edits were applied. The standard comes from the Coalition for Content Provenance and Authenticity, and it is what sits behind the “Content Credentials” label you see in Adobe products and several AI image tools.
Anthropic attaches them to file output including .png, .jpg and .svg. OpenAI attaches them to image output. Camera makers are shipping them too.
Strong signature, weak attachment
This is the distinction that explains everything else about C2PA.
The signature is real cryptography. You cannot forge a manifest that claims a file came from a tool it did not, and you cannot alter the recorded history without invalidating it. That part works.
The attachment is just metadata riding alongside the pixels. And metadata is the most casually discarded part of any file.
| Action | Manifest survives? |
|---|---|
| Upload to most social platforms | Usually stripped |
| Convert PNG to JPG | Usually lost |
| Re-save in an editor that does not support C2PA | Lost |
| Screenshot the image | Lost, entirely |
| Resize or crop with a basic tool | Usually lost |
| Edit in a C2PA-aware tool | Preserved and appended to |
So the absence of Content Credentials tells you nothing. Almost every image on the internet has passed through at least one step in that table.
Why it was built this way
Because the alternative has its own costs. A signal embedded in the pixels, as SynthID does, survives re-saving and cropping far better, but it cannot carry a rich, human-readable, cryptographically verifiable edit history. C2PA chose auditability over durability.
The design assumption is an ecosystem where tools preserve manifests as they pass files along. That ecosystem is partly built. Until it is fully built, C2PA works as a positive signal when present and means nothing when absent.
What this means for watermark removal
Two things, and they point the same way.
First, stripping a manifest is trivial, which means it is not a capability worth building or advertising. A screenshot does it. Nobody needs a tool.
Second, stripping one deliberately is the problem, precisely because it is so easy to do by accident. The act that matters is intent: removing provenance so people cannot tell how a file was made is out of scope for this site permanently, and it is prohibited by the Acceptable Use Policy.
Image mode here rebuilds pixels under a visible mark. It does not target manifests. If you re-save the output, the manifest will likely be gone as a side effect of the export, which is exactly the accidental case the standard already struggles with.
How to check a file yourself
The Content Credentials verify page at verify.contentauthenticity.org accepts a file and shows any manifest it carries. exiftool will dump the raw metadata blocks if you prefer the command line. Both tell you what is present; neither can tell you what was stripped, because a removed manifest leaves no trace.
Who this is not for
Anyone hoping C2PA settles whether an image is real. It cannot. It is a chain-of-custody record that survives only when every tool in the chain cooperates, and it is silent about everything that happened before the first C2PA-aware tool touched the file.
Related: what Claude’s text watermark actually is, which takes the opposite design approach for text.