C2PA Content Credentials, and why they wash off

C2PA is an open standard for attaching signed provenance metadata to a file, recording what made it and how it was edited. Anthropic uses it for the .svg, .png and .jpg files Claude generates[1][10]; its developer documentation lists fourteen signed formats, all of them image, video or audio, and says text files, PDFs and office documents are not signed[13]. Because it is metadata carried alongside the pixels rather than hidden inside them, it survives honest handling and disappears the moment anyone screenshots, re-encodes or uploads the file to a platform that strips metadata.

How does C2PA metadata differ from an embedded watermark?

The two are complementary rather than competing, which is why providers ship both. The signature gives you trustworthy detail when it is present; the watermark gives you a weak signal that persists when the metadata is gone.

OpenAI describes exactly this reasoning: metadata is not foolproof and can be stripped, lost through uploads and downloads, or broken by format changes, resizing or screenshots, so it layers SynthID watermarking underneath C2PA rather than relying on either alone[9]. It has also become a C2PA Conforming Generator Product, which is what lets other platforms read and preserve the provenance data rather than discarding it[9].

What does this mean in practice?

If a Claude-generated image reaches you with its Content Credentials intact, you can read exactly what produced it. Anthropic's developer documentation says what the credential holds: a cryptographically signed manifest naming Anthropic as the issuer, a timestamp, and the action description "Claude provided this file at the request of a user and may have created or modified the file contents" — and nothing about the user, their organisation or their request[13]. Any C2PA-aware tool reads it — Anthropic names the open-source c2patool[13] — and Anthropic now runs one of its own: the free Claude Content Checker, which reads the credential in your browser without uploading the file[1][11]. Note what it is. It takes images, video and audio — JPG, PNG, GIF, WEBP, TIFF, HEIC, AVIF, SVG, DNG, JXL, MP4, MOV, AVI, WAV, MP3, M4A and FLAC, up to 100 MB[11] — and it does not take text. It is not the text watermark detector, which stays in private preview[1]. If the file reaches you as a screenshot in a group chat, you have nothing. Absence of credentials is not evidence of anything — Anthropic makes the equivalent point about text, noting that stripped metadata is one of the reasons unmarked content may still be AI-generated[1].

You can check a file for C2PA data yourself with our scanner, which looks for a manifest marker without uploading the file anywhere.

What does the EU require of it?

The EU's Code of Practice requires marking that is machine-readable and detectable, and asks that the technical solutions be effective, interoperable, robust and reliable as far as technically feasible[2]. That last clause is doing real work: metadata that any re-encode removes is arguably none of those things, which is why providers pair it with an embedded mark rather than relying on it alone.

Last verified against primary sources: 2026-09-18