Content Credentials (C2PA)

Content Credentials are signed records attached to a media file that describe where it came from and what was done to it. The format is defined by the Coalition for Content Provenance and Authenticity (C2PA), so the technical name for a credential is a C2PA manifest. Cameras from Leica, Sony and Google, Adobe's tools and several AI image generators write them today.

A manifest lists assertions, such as the actions taken on the file (created, edited, cropped, resized) and the source of the content, for example a camera capture or a trained AI model. A hash binds those statements to the file's bytes, and an X.509 certificate signs the whole. A verifier can then report whether the file is unchanged since signing (valid) and whether the certificate chains to the official C2PA trust list (trusted). These are two separate results: anyone can sign a manifest, but only a trust-list certificate identifies a known signer.

Credentials have limits. Resizing or converting a file breaks the hash, many platforms remove manifests on upload, and a manifest only records what the signing tool declared. A file without credentials proves nothing about how it was made.

In a DAM, credentials are read at upload so the library can be filtered by them: leaving AI-generated images out of a campaign, or keeping only verified camera captures for editorial use. Freedam verifies every uploaded original against the C2PA trust list and shows the status, the signer and the action history on the asset page. The Content Credentials page shows how it works, and the guide What can C2PA Content Credentials prove? covers the standard in detail.

Related terms: Metadata, Usage rights, Ingestion