Quick answer
Content Credentials are a provenance standard from the C2PA coalition (Adobe, Microsoft, Google, OpenAI, the BBC, camera makers, and others). A supporting tool attaches a cryptographically signed manifest to a file recording the tool, the edits, and whether AI generated or altered the content. Anyone can inspect it; editing the file with a non-supporting tool breaks the signature. They record AI use at creation rather than trying to detect it afterwards.
AI detectors guess whether an image is synthetic by looking at it, and they are wrong often enough to be dangerous. Content Credentials take the opposite approach: the tool that made the image writes down what it did, signs the note, and attaches it. Provenance instead of forensics.
What the manifest contains
- The tool or device that created the file, such as a camera model or Adobe Firefly
- A list of actions: generated with AI, cropped, colour-corrected, composited
- Optionally the creator's identity, if they chose to sign it
- A cryptographic signature that fails if the file is altered outside the chain
Who supports it
Adobe attaches credentials to Firefly output and across Creative Cloud; OpenAI signs DALL-E images; several camera bodies from Leica, Sony, and Nikon sign photos at capture; LinkedIn, TikTok, and others display a label when credentials are present. Google has committed to the standard across its products. Coverage is growing but far from universal, and that is the main limitation.
What they cannot do
A file without credentials proves nothing; most images online have none, either because the tool did not attach them or because a screenshot, re-encode, or upload stripped the metadata. Credentials can be removed. They also do not judge truth: a real photo can be captioned with a lie. What they provide is a reliable positive signal: if credentials are present and valid, you know how the file was made.
Bottom line
Content Credentials are the closest thing to a nutrition label for media. They will not end misinformation, but as more tools and platforms adopt them, "no credentials" itself becomes a reason to look closer.
