Content provenance (C2PA)

What content provenance means

Content provenance is a record of where a piece of media came from and how it has been edited, attached to the file so that others can check it^[1]. It differs from a caption or a credit line in one important way: the record travels with the asset rather than sitting somewhere else, and it is meant to be inspected rather than simply read.

The standard behind most current work on this is published by the Coalition for Content Provenance and Authenticity (C2PA), launched on 22 February 2021 as a Joint Development Foundation project by Adobe, Arm, BBC, Intel, Microsoft and Truepic^[1]. Its stated purpose is to address disinformation, misinformation and online content fraud by developing technical standards for certifying the source and history, or provenance, of media content^[1].

How a manifest works

Under the specification, a C2PA manifest combines a set of assertions, a single digitally signed claim, and a claim signature generated with the signer's private key^[4]. The assertions are the individual statements recorded about the asset; the claim gathers them into one signed statement; the signature ties that statement to a particular signer.

The manifest also has to be tied to the content itself. A content binding is either a hard binding made of cryptographic hashes or a soft binding that is a content identifier such as a fingerprint or an invisible watermark embedded in the content^[4]. A hard binding works like a seal over the exact file, because a hash computed from the file can be compared with the value stored in the manifest; a soft binding instead uses an identifier carried inside the content, such as a fingerprint or an invisible watermark^[4].

A concrete example: a photograph arrives at a newsroom. Someone checking it can recompute the hash from the file and compare it with the hash recorded in the manifest. If the file has been altered since it was signed and the manifest has not been updated to match, the two values no longer agree. A reader of the manifest can then see the assertions the signer made, the signature that identifies the signer, and evidence about whether the content still matches what was signed.

The specification itself defines what information is associated with each asset type, how that information is presented and stored, and how evidence of tampering can be identified^[2].

From two projects to one coalition

The coalition brought together the founding members of two earlier efforts, the Adobe-led Content Authenticity Initiative and the Microsoft- and BBC-led Project Origin, and unified their technical specifications under one body^[1]. Work then moved through a public process: a draft specification was released in September 2021 and went through a community review period^[2]. Version 1.0 was released on 26 January 2022, which C2PA described as the first industry standard of its kind and as enabling tamper-evident media^[2]. Version 2.3 of the technical specification was published in December 2025^[4].

Content Credentials

The consumer-facing implementation of the standard is branded Content Credentials, which C2PA describes as working like a nutrition label for digital content^[3]. The comparison points at a short, standardised panel of information: a viewer gets a quick sense of what they are looking at without having to follow the machinery underneath it.

What the standard is for

What the standard provides is a checkable record: where a piece of content came from, how it has been edited, and a way to see whether it has been tampered with since it was signed^[1][2]. That is the gap the coalition set out to fill, in a setting where media circulates far from the place it was made and where editing tools are everywhere^[1].