C2PA Metadata: Provenance, Examples and How to Verify It

C2PA metadata is provenance information that can be cryptographically bound to digital media so people and software can inspect where an asset came from, how it was created, and what changes were declared along the way. It is used by the C2PA standard behind Content Credentials, and it applies to more than AI-generated media. A Content Credential can describe captured photos, edited videos, generated assets, source ingredients, software actions, and other parts of a file’s history.

The most important thing to understand is what C2PA does not do. It is not a truth detector and it is not the same as an AI detector. Valid provenance can help establish that certain information was signed and remained bound to a particular asset, but it does not automatically prove that the scene is factual, the caption is accurate, or the signer is making a truthful claim.

Quick answer: when people search for “C2PA metadata,” they usually mean the provenance data stored in a C2PA Manifest or Content Credential. Technically, the standard also defines a specific c2pa.metadata assertion for selected metadata fields. A complete Content Credential can contain much more than that one assertion, including actions, ingredients, content bindings, signatures, timestamps, source types, and AI disclosure information.

Term	What it means	What it can tell you
C2PA	The open technical standard for content provenance	How provenance data should be created, bound, signed, validated, and presented
Content Credential	The preferred user-facing term for a C2PA Manifest	Provenance claims associated with a specific asset
C2PA Manifest	A signed structure containing assertions about an asset	Origin, actions, ingredients, metadata, bindings, and other provenance signals
c2pa.metadata	A specific metadata assertion defined by the standard	Selected fields from common metadata schemas such as EXIF, TIFF, IPTC, and XMP-related data
Assertion	A statement included in a manifest	An action, metadata value, ingredient, AI disclosure, content binding, or another provenance fact
Signer	The entity whose credential signs the claim	Who is cryptographically associated with the assertions in that claim

What Is C2PA Metadata?

C2PA stands for the Coalition for Content Provenance and Authenticity. The coalition maintains an open standard for attaching verifiable provenance information to digital assets such as images, video, audio, documents, and other supported media.

In everyday language, “C2PA metadata” is often used as shorthand for the provenance information carried by Content Credentials. That information can describe:

• how an asset was created
• which software or hardware participated in the workflow
• what edits or transformations were declared
• whether other source assets were used as ingredients
• how the manifest is bound to the media
• which credential signed a claim
• selected capture or descriptive metadata
• signals about AI generation or AI-assisted processing

The current C2PA technical specification is version 2.4, published in April 2026. It defines the data structures, cryptographic validation rules, assertions, embedding methods, trust model, and supported media workflows used by Content Credentials.

If you want the broader non-technical explanation of the user-facing system, see our Content Credentials guide. This article focuses specifically on the provenance metadata and technical signals underneath that experience.

C2PA Metadata Is Not the Same as Ordinary EXIF Metadata

This distinction is essential because traditional metadata and C2PA provenance can contain similar-looking information while offering very different security properties.

Ordinary metadata such as EXIF, IPTC, TIFF, or XMP fields can record useful facts including camera model, creation date, GPS coordinates, copyright information, creator details, and editing software. But ordinary metadata by itself is generally just data stored in or alongside the file. It can be removed or changed without providing a cryptographic provenance chain.

C2PA can place selected metadata inside a signed assertion. When that happens, the signer is explicitly asserting those values as part of the manifest, and the data becomes part of a structure that can be cryptographically validated.

Ordinary metadata	C2PA provenance
May contain EXIF, IPTC, XMP, device or descriptive fields	May include selected metadata plus provenance-specific assertions
Usually not signed as a provenance claim	Assertions are incorporated into a digitally signed claim
Can be useful even without a trust model	Validation includes cryptographic integrity and signer trust considerations
Does not normally describe a complete edit chain	Can record actions and relationships between source ingredients
Presence does not establish attribution	Signed assertions can be attributed to the signer of the claim

The C2PA specification does not replace EXIF, IPTC, or XMP. It can work with metadata derived from those schemas and place selected values inside a tamper-evident provenance structure.

The Technical Meaning of c2pa.metadata

There is an important naming detail that many C2PA explainers miss.

A C2PA Manifest can contain many different assertions. The standard defines a particular assertion labeled c2pa.metadata. This assertion is used to represent a supported subset of common metadata schemas in JSON-LD form.

That means two statements can both be true:

1. People commonly use “C2PA metadata” to describe Content Credentials and provenance data in general.
2. The specification also has one exact technical structure called the c2pa.metadata assertion.

The second meaning is narrower. A manifest can be rich in provenance information even if the part you care about is not stored inside c2pa.metadata. For example, editing actions belong in an actions assertion, source relationships can appear as ingredients, and AI transparency can be expressed through source types and newer AI-specific assertions.

What Does a C2PA Provenance Record Contain?

Think of a Content Credential as a signed package of structured claims rather than a single metadata tag. Several components work together.

Actions

Actions describe what happened to the asset. Depending on the workflow, they can represent creation, opening an existing asset for editing, placing another asset into a composition, editing, publishing, redaction, transcoding, and other operations defined by the specification.

Under the current specification, a standard manifest must include an actions assertion. When an asset is created from scratch, captured by a camera, or generated by a model, the first relevant action can describe that creation and its digital source type.

Digital source type

The digitalSourceType value helps describe the nature of the asset at creation. This is important for distinguishing, for example, digitally captured media from trained algorithmic media produced by a generative model.

This is much more precise than a generic label such as “AI” because the provenance model records the source classification as part of the declared workflow.

Ingredients

An ingredient is another asset or piece of data used to create or modify the current asset. A video could contain an imported image, another video clip, an audio track, or an input used by a computational process.

Ingredients matter because provenance becomes more informative when a viewer can understand how a final asset relates to earlier source material.

Metadata assertions

The c2pa.metadata assertion can carry selected metadata fields. Examples in the current specification include values such as creation information, camera details, lens information, GPS-related fields, and digital source information, depending on the asset and what the signer chooses to assert.

Content bindings

A Content Credential needs a way to associate provenance with the asset it describes. C2PA uses hard bindings such as cryptographic hashes and can also support soft-binding approaches for provenance discovery.

This binding is why changing relevant file content can cause validation to fail even if someone copies the visible metadata text.

Signature and trust information

The claim is digitally signed. Validation checks whether the signature and content bindings are correct and whether the signing credential can be evaluated under the applicable trust model.

The C2PA ecosystem also maintains an official Trust List under its Conformance Program. Trust is not simply “the signature exists.” A validator has to consider whether a valid signature chains to a recognized trust anchor and whether the assertions should be trusted in context.

C2PA Provenance Metadata Example

A concrete example makes the structure easier to understand. Imagine a camera captures an image or video frame and a C2PA-aware workflow records selected camera metadata plus a creation action.

A simplified, illustrative metadata assertion could look like this:

{
  "@context": {
    "exif": "EXIF namespace",
    "tiff": "TIFF namespace",
    "iptc": "IPTC namespace"
  },
  "created": "2026-08-19T10:15:00Z",
  "digitalSourceType": "digitalCapture",
  "cameraMake": "Example Camera Co.",
  "cameraModel": "Model X",
  "location": {
    "latitude": "example value",
    "longitude": "example value"
  }
}

This is intentionally simplified for readability. The actual C2PA specification uses defined namespaces, field names, data types, and serialization rules. The important idea is that selected metadata values can be placed inside an assertion that is part of a signed C2PA Manifest.

Now imagine the asset is opened in an editor and cropped. A later manifest could declare an editing action and identify the earlier asset as an ingredient. Instead of replacing history with one final metadata block, the provenance model can represent relationships across stages of the asset’s life.

What the example proves

If validation succeeds, you can establish that the relevant signed assertion is cryptographically associated with the asset and has not been silently modified without affecting validation.

What the example does not prove

It does not prove that the GPS coordinates describe the real-world location, that the camera was held by a particular journalist, or that a caption attached later is truthful. Those are claims that require context and trust in the signer or supporting evidence.

This separation between verifiable provenance and factual truth is one of the most important concepts in the entire C2PA standard.

A Content Credential Is More Than One Metadata Block

It is tempting to imagine C2PA as a special EXIF tag called “AI: yes” or “AI: no.” That model is too simplistic.

A useful provenance record may contain several assertions that answer different questions:

Question	Relevant C2PA signal
How was the asset first created?	Creation action and digital source type
Was another asset used?	Ingredient relationship
What software performed an action?	Software agent information associated with actions
Which selected camera or descriptive fields were asserted?	c2pa.metadata
Is the provenance still bound to this asset?	Hard or soft content bindings and validation
Who signed the claim?	Signing credential and trust evaluation
Was AI involved in the creation workflow?	Digital source type, actions, ingredients, and AI disclosure when used

This multi-layer structure is why C2PA is better understood as a provenance architecture than as ordinary metadata.

How to Check C2PA Metadata in a File

You do not need to decode binary structures manually. For most users, a conforming inspection tool is the practical starting point.

1. Use the strongest version of the asset

Whenever possible, inspect the original downloaded file rather than a screenshot, screen recording, or heavily processed social-media copy. Re-encoding and platform transformations can remove embedded provenance.

2. Open the asset in a C2PA-aware inspector

The Content Credentials Inspect tool can accept supported media files and display Content Credentials when they are available. Current support includes common image formats plus video and audio formats such as AVI, MOV, MP4, M4A, MP3, and WAV, as well as PDF.

3. Look beyond the presence of the credential

Do not stop at “Content Credentials found.” Review the provenance record:

• What does it say about creation?
• Which actions are declared?
• Are ingredients present?
• What software or hardware is identified?
• What signer information is available?
• Does validation succeed?
• Does the history make sense for the media you are viewing?

4. Compare the provenance with the claim

A perfectly valid credential is still only useful when interpreted against the real question. If a viral video claims to be a raw camera recording but the provenance shows a composite editing workflow, that discrepancy matters. If it shows ordinary color correction, the existence of an edit does not automatically make the video deceptive.

Reading Validation Results: Well-Formed, Valid and Trusted

C2PA validation is more nuanced than a green checkmark.

Well-formed

The asset and provenance structures can be parsed according to the expected syntax.

Valid

Cryptographic and structural validation succeeds for the relevant manifest data, signatures, bindings, and related checks.

Trusted

Trust adds another layer. A valid signature can be evaluated against recognized trust anchors and credential policies. The question becomes not only “Is this signature mathematically valid?” but also “Is this signer accepted under the validator’s trust configuration?”

This is why a technically valid credential from an unknown or untrusted signer should not be interpreted the same way as one issued through a trusted conforming workflow.

What C2PA Metadata Can Actually Verify

When the provenance is present, correctly validated, and relevant to your question, it can provide strong evidence about the digital history of the asset.

Depending on the credential, that may include:

• the asset’s declared creation method
• specific declared edit or transformation actions
• software or hardware involved in those actions
• relationships to source ingredients
• selected asserted metadata values
• cryptographic integrity of the signed provenance
• the signer associated with the claim
• AI-related provenance signals when the workflow records them

For source investigations, C2PA complements broader video provenance analysis, where you may also need upload history, platform records, original files, timestamps, and source attribution.

What C2PA Metadata Cannot Prove

The current page title on many sites overstates this point. C2PA can strengthen evidence about origin and history, but “proof of origin” needs to be interpreted carefully.

It cannot prove the scene is true

A staged photograph, fictional video, or misleadingly framed scene can have valid provenance.

It cannot verify a caption added outside the asset

A real video can be reposted with a false date, false location, or false description.

It cannot guarantee the signer is honest

Cryptography can show who signed a claim under a credential. It cannot force that signer to make a truthful assertion.

It cannot make missing history appear

Provenance may be incomplete. An asset can pass through tools that do not record every action before re-entering a C2PA-aware workflow.

It cannot guarantee the credential survives distribution

Re-encoding, screenshots, screen recordings, exports, or platform processing may remove embedded credentials or create a new derivative asset.

For this reason, Content Credentials should be combined with contextual video verification when the factual claim matters.

What Happens When C2PA Metadata Is Removed?

There are two different questions here: what happens to the embedded data, and what happens to the ability to recover provenance.

An application may strip embedded provenance during export or re-encoding. A screenshot or screen recording also creates a new asset whose embedded manifest does not automatically inherit the original asset’s provenance.

C2PA therefore supports more than one binding strategy. Hard bindings cryptographically associate a manifest with specific content, while soft-binding mechanisms can help discover provenance through approaches such as fingerprints or invisible watermarks when implemented by the ecosystem.

The key rule for verification is simple:

Missing C2PA metadata is not evidence that an asset is fake.

It means only that usable C2PA provenance was not available in the version you inspected. You may need another copy, the original source, or a different verification method.

C2PA Metadata and AI-Generated Content

C2PA is often discussed as an AI-labeling technology, but its scope is broader. It was designed for digital provenance in general.

Still, the current specification includes several mechanisms that can provide useful AI transparency.

Digital source type

A creation action can declare a source type associated with trained algorithmic media. This provides a machine-readable signal about how the asset originated.

Ingredients

Inputs used in a generative or AI-assisted process can be represented as ingredients when the workflow records them.

AI Disclosure in C2PA 2.4

C2PA 2.4 introduced the c2pa.ai-disclosure assertion. It is designed to complement existing actions and source types with machine-readable AI transparency information, including information about models and the level of human oversight when a conforming workflow chooses to provide it.

This is an important evolution because provenance can move beyond a binary “AI or not” label and describe more of the creation process.

For media where no trustworthy provenance exists, technical analysis still has a separate role. The AI video analysis guide explains how content-based evidence differs from provenance evidence.

What Changed in C2PA 2.4?

As of August 2026, C2PA 2.4 is the current published technical specification. It was released in April 2026.

Several changes matter for people working with provenance:

• a new AI Disclosure assertion for structured AI transparency
• a new JSON-LD representation called crJSON for profile evaluation, interoperability testing, and validation reporting
• a Repository Receipt assertion for recording proof that a manifest was ingested by a C2PA Manifest Repository
• improvements and clarifications around actions, ingredients, live video, and cryptography
• continued support for a wider range of digital asset formats and workflows

crJSON is worth interpreting carefully. It is a derived JSON view of C2PA data for evaluation and reporting. It is not itself a separately verifiable replacement for the signed manifest.

C2PA Metadata in Video Files

C2PA is not limited to still images. The specification supports provenance in video formats including MP4 and MOV, and version 2.x also includes live-video architecture.

For BMFF-based formats such as MP4, the manifest store is embedded using a defined box structure within the file. A verifier does not need to understand the container layout manually, but this technical design allows provenance to travel with supported video assets.

For a video investigation, useful C2PA signals may include:

• how the video was created
• whether the workflow reports captured or algorithmic origin
• declared editing actions
• software agents involved
• source video or audio ingredients
• AI disclosure information
• signer and validation status

This can be particularly valuable when a file is presented as “original footage.” The provenance may support that description, contradict it, or simply be unavailable.

Does CapCut Export C2PA Content Credentials?

This question needs a precise answer because “CapCut” covers multiple editing and generative products and workflows.

CapCut’s official newsroom has confirmed that AI-generated content from Dreamina Seedance 2.0 is labeled with visible watermarks and embedded C2PA Content Credentials. That establishes C2PA support for that specific generative workflow.

It does not establish that every ordinary CapCut edit or every export from every CapCut app automatically adds or preserves C2PA provenance. If C2PA preservation matters, verify the exported file itself rather than assuming support based on the product name. CapCut describes the confirmed Dreamina behavior in its official Seedance 2.0 announcement.

C2PA vs Watermarks vs AI Detectors

These technologies are often grouped together, but they answer different questions.

Technology	Main purpose	Typical question
C2PA / Content Credentials	Verifiable provenance	What history has been declared and cryptographically bound to this asset?
Ordinary metadata	Descriptive or technical information	What camera, date, location, or software fields are present?
Invisible watermark	Durable machine-readable signal	Can a hidden marker help identify or recover information about the asset?
Visual or audio AI detector	Content-based inference	Does the media contain patterns associated with synthetic generation or manipulation?
Source verification	Context and publication history	Who posted this, when, where, and with what original claim?

These approaches are complementary. Provenance records declared history. Detection infers from content. Source verification examines the surrounding evidence.

When C2PA and Detection Disagree

A useful verification system must be able to handle conflicting signals.

Valid provenance, suspicious content

Do not discard the content-based concern. Check what the manifest actually asserts, who signed it, whether the suspicious region predates the signed stage, and whether the asset contains ingredients that explain the result.

No C2PA, clean detector result

This is still not proof of authenticity. You have an asset without usable provenance and no strong detector signal. Source verification is still necessary for important claims.

AI-related provenance, realistic-looking content

There is no contradiction. High-quality AI-generated or AI-assisted media can look realistic. Provenance may reveal the production method even when the pixels do not look suspicious.

Captured provenance, false caption

Again, there is no contradiction. Provenance can support that the media was captured, while the surrounding post can still lie about what, where, or when it shows.

A Practical C2PA Verification Workflow

For a high-impact image or video, use C2PA as one layer in a short evidence sequence.

1. Obtain the best available asset. Prefer the original file or the earliest high-quality copy.
2. Inspect Content Credentials. Determine whether a C2PA Manifest is available.
3. Check validation. Review integrity, signature, bindings, and trust status rather than only the presence of metadata.
4. Read the actions. What creation and editing steps are declared?
5. Inspect ingredients. Was the asset derived from other media?
6. Read metadata selectively. Are creation, device, location, or source fields relevant to the claim?
7. Check AI provenance. Look for digital source information and AI disclosure signals when present.
8. Compare with the real-world claim. Does provenance agree with the date, source, identity, and story attached to the asset?
9. Add independent evidence. Use source history and content analysis if provenance is incomplete or the stakes are high.

If you need to investigate the media itself after the provenance check, DetectVideo AI can provide an additional analysis layer for supported video footage. Provenance and detection should support each other rather than being treated as interchangeable verdicts.

Common Mistakes When Reading C2PA Metadata

“C2PA present” means “real”

No. It means provenance information is available. You still need to understand the assertions and signer.

“No C2PA” means “fake”

No. The asset may come from a workflow that never added Content Credentials, or the provenance may have been stripped during distribution.

“Valid signature” means “trusted source”

Not necessarily. Cryptographic validity and trust evaluation are related but distinct.

“Edited” means “deceptive”

No. A manifest may honestly disclose cropping, color correction, transcoding, or other normal production steps.

“AI-related metadata” means the whole asset was generated

Not necessarily. AI can be involved in only one part of a larger workflow. Read actions, source type, ingredients, and disclosure information together.

“Metadata tells me the whole history”

Not always. Provenance can be incomplete, redacted, removed, or restarted after a gap. Interpret the record you have, not the record you wish existed.

Key Takeaway

C2PA metadata is best understood as signed provenance, not a magic authenticity label. It can bind structured claims about creation, editing, source ingredients, metadata, and AI involvement to a digital asset in a way that can be cryptographically validated.

The phrase “C2PA metadata” is also broader in common usage than the technical c2pa.metadata assertion. A Content Credential can contain actions, ingredients, signatures, bindings, source types, AI disclosures, and other provenance signals that are just as important as traditional metadata fields.

When the credential is present, inspect what it actually says, whether it validates, who signed it, and whether that history supports the claim you are evaluating. When it is absent, do not assume the asset is fake. Move to source verification and content analysis instead.

FAQ About C2PA Metadata

What is C2PA metadata?

C2PA metadata commonly refers to provenance information carried in Content Credentials. It can describe how digital media was created or modified and is stored in signed C2PA manifests. The specification also defines a specific c2pa.metadata assertion for selected metadata fields.

What is C2PA provenance metadata?

C2PA provenance metadata is structured information about the history of a digital asset. It may include creation actions, edits, source ingredients, software, selected metadata, cryptographic bindings, signer information, and AI-related provenance signals.

What is an example of C2PA metadata?

An example could include a signed assertion containing a creation date, digital source type, camera make and model, or location information. Other assertions in the same Content Credential could record editing actions, source ingredients, and the software involved.

Is C2PA metadata the same as EXIF?

No. EXIF is a conventional metadata schema used for fields such as camera and capture information. C2PA can include selected metadata derived from schemas such as EXIF inside signed provenance assertions, while also adding actions, ingredients, signatures, bindings, and other provenance structures.

Does C2PA prove that a video is authentic?

It can provide strong cryptographic evidence about declared provenance and integrity, but it does not prove that the real-world story, caption, location claim, or signer statement is true. Provenance and factual verification are different tasks.

How do I check C2PA metadata?

Use a C2PA-aware inspection or validation tool with the original media file when possible. Review the Content Credential, validation status, signer, creation and editing actions, ingredients, and metadata rather than checking only whether a credential exists.

Can C2PA metadata show if AI was used?

Yes, when the creating workflow records appropriate provenance. Digital source types can indicate trained algorithmic media, and C2PA 2.4 also defines an AI Disclosure assertion for richer machine-readable AI transparency.

What is the difference between C2PA and Content Credentials?

C2PA is the technical standard and ecosystem for verifiable content provenance. A Content Credential is the preferred user-facing term for a C2PA Manifest, and Content Credentials also refers more broadly to the technology built on that standard.

Can C2PA metadata be removed?

Embedded provenance can be lost through workflows that strip or re-encode metadata, and screenshots or screen recordings create new assets. C2PA also supports approaches such as soft bindings that can help recover or reconnect provenance in compatible ecosystems.

Does missing C2PA metadata mean a file is fake?

No. Many legitimate assets have no C2PA provenance, and credentials can be removed during normal distribution or editing. Absence means that usable C2PA provenance was not available in the copy you inspected.

What is a C2PA Manifest?

A C2PA Manifest is a verifiable structure containing one or more assertions about a digital asset. Assertions, the claim, signature, and content bindings work together to represent provenance associated with that asset.

What are C2PA ingredients?

Ingredients represent other assets or inputs used to create or modify the current asset. They help describe relationships such as an original file opened for editing or components placed into a composite asset.

Does CapCut support C2PA Content Credentials?

CapCut has officially confirmed embedded C2PA Content Credentials for AI-generated content from Dreamina Seedance 2.0. That should not be generalized to every CapCut editing or export workflow. Inspect the exported asset if C2PA preservation is important.

What is new in C2PA 2.4?

C2PA 2.4, published in April 2026, adds features including AI Disclosure, crJSON for evaluation and reporting, Repository Receipt assertions, and improvements related to actions, ingredients, live video, and cryptography.

Primary Technical References

• C2PA Technical Specification 2.4, the primary specification for assertions, manifests, actions, metadata, AI disclosure, validation, supported formats, and content bindings.
• C2PA and Content Credentials Explainer, the coalition’s plain-language explanation of provenance, trust, assertions, Content Credentials, and limitations.
• C2PA Conformance Program, including the current C2PA Trust List and conforming product information.
• C2PA Tool documentation, official open-source instructions for reading and working with C2PA manifests from the command line.