Guides
Content Credentials (C2PA) Explained in Plain English
Quick Answer
Content Credentials are a signed record attached to a file that can show which device or app made it and how it was edited. They follow an open standard called C2PA. You can check a file for free at contentcredentials.org/verify. They are useful when present, but screenshots and many social apps remove them, so a missing credential does not mean a photo is fake.
You may have seen a small "CR" icon on an image, or read that a phone now "signs" its photos. Both are about Content Credentials. This guide explains them in plain English: what they are, how to check them, and where their limits are.
What Content Credentials are
A Content Credential is a small, signed record that travels inside a file. Think of it as a label with a seal. The label says where the file came from and what happened to it. The seal is a digital signature, so if someone changes the file or the label later, the check shows it.
"Content Credentials" is the name people see, often as a small CR icon. The technical standard underneath is called C2PA. It works for photos, videos, audio and documents.
Who is behind the standard
C2PA stands for Coalition for Content Provenance and Authenticity. It was formed in February 2021 by Adobe, Arm, BBC, Intel, Microsoft and Truepic, and it runs as a project under the Linux Foundation. Many more companies have joined since. The standard is open and free to use.
A related group, the Content Authenticity Initiative, works on getting the standard used in real tools. You will see both names when you read about this topic.
What a credential records
The technical name for the record is a manifest. It is a signed package of statements, called assertions. Depending on the device or app, a manifest can include:
- the device or app that made the file;
- the date and time it was made;
- edits that were made, and in which app;
- whether an AI tool generated or changed the content;
- who signed the record.
Not every manifest has all of these. What is recorded depends on the tool that wrote it, and some details, like location, can be left out on purpose for privacy.
How to check a photo
- Get the original file. A screenshot will not work. Download the image itself, ideally from the first place it was posted.
- Open the verify site. Go to contentcredentials.org/verify, the free official checker.
- Upload the file. If credentials are present, you see who signed them and the recorded history. If not, the site tells you none were found.
- Read it calmly. A valid credential tells you what the signer recorded. It does not tell you whether the scene is true.
Some websites and apps also show a CR icon on images that carry credentials. Clicking it shows a short summary.
What they prove, and what they do not
| A valid credential tells you | It does not tell you |
|---|---|
| Who signed the record | Whether the scene in the photo is true |
| That the file has not changed since it was signed | What happened before the signing, if it was not recorded |
| The history the tools recorded, such as edits or AI use | Anything about photos that never had credentials |
The most common mistake is to read it the other way round. A photo without credentials is not fake. A photo with credentials is not automatically true. The credential is evidence about the file, and you still need to think about the content.
Why they are often missing
Content Credentials live in the file's metadata. That makes them easy to lose:
- Screenshots. A screenshot is a new file. It does not carry the old record.
- Re-uploads. Many social apps remove metadata when you upload a photo, and the credential goes with it.
- Editing in other apps. Saving the file in a tool that does not support the standard can drop the record.
- No warning. Once removed, the file gives no sign that it ever had credentials.
Researchers are working on ways to make credentials survive, for example by combining them with invisible watermarks or fingerprints of the image. As of October 2026 this is still developing. For now the practical advice is simple: if you need to prove where your photo came from, keep the original file.
Where things stand in 2026
Support is growing but uneven. As of October 2026:
- some cameras and phones can sign the photos they take;
- some AI image tools add a credential that says the image was generated;
- some editing apps record the edits they make;
- some platforms show a label when an image carries credentials, while many still remove them on upload.
Rules are also changing. In the European Union, the AI Act asks providers of AI systems to mark generated content in a machine-readable way, with these transparency rules applying from August 2026. For AI systems that were already on the market before then, the deadline for this machine-readable marking was reported to be December 2026. Standards like C2PA are one way to do that.
How Rawly fits in
Rawly is a photo and video challenge app. It does not use Content Credentials today. It answers a narrower question in its own way:
- Live camera only. Every photo is taken with the camera inside the app. There is no gallery upload.
- A code on every shared photo. When someone shares or saves a photo from Rawly, it carries a short code that starts with RWLY.
- Anyone can check it. Type the code at rawly.app/verify to see Rawly's own copy and the minute it was taken. No account is needed.
The limits are clear. The code proves when a photo was taken in Rawly, not who took it, and it only covers photos taken in Rawly. Content Credentials aim at something wider: a record that can follow a file across many apps. The two ideas can work side by side.
For a full set of checks you can use on any photo, read how to tell if a photo is real or AI-generated.
Questions
What are Content Credentials?
Content Credentials are a signed record attached to a photo, video or other file. They can show which device or app made the file and how it was edited. They follow an open standard called C2PA.
What is C2PA?
C2PA stands for Coalition for Content Provenance and Authenticity. It is a group of companies and organizations that writes the open technical standard behind Content Credentials. It was formed in 2021 and runs as a project under the Linux Foundation.
How do I check if a photo has Content Credentials?
Upload the original file to the free Content Credentials verify site at contentcredentials.org/verify. If credentials are present and valid, it shows who signed them and the recorded history. Some apps also show a small CR icon you can click.
Do Content Credentials prove a photo is real?
Not on their own. They show who signed the file and what history was recorded. They do not judge whether the scene is true, and a signer can still make mistakes or record only part of the history.
Does missing Content Credentials mean a photo is fake?
No. Most photos never had them, and many social apps remove them on upload. A screenshot also removes them. Missing credentials tell you very little.
Does Rawly use Content Credentials?
Not today. Rawly uses its own check: every photo shared from the app carries a short code, and anyone can type it at rawly.app/verify to see Rawly's copy and the minute it was taken. It only covers photos taken in Rawly and proves when, not who.
Photos you can check.
Free on iOS and Android. Shoot today's challenge live with everyone else.
Get the app →On a computer? Scan the QR code