What are C2PA Content Credentials?
C2PA (Coalition for Content Provenance and Authenticity) is an open standard for recording where an image comes from. Participating tools embed a manifest (stored as a JUMBF block inside the file) that declares the capture device or generator, the editing steps, and whether generative AI was used. Adobe markets it to end users as Content Credentials.
What does this C2PA checker show?
Pixvisor scans the file at the byte level for C2PA containers (JUMBF / caBX boxes) and C2PA-related XMP tags, alongside the rest of the metadata: IPTC digitalSourceType, generation parameters and software tags. If credentials are present you'll see exactly which signals were found and what the surrounding metadata declares about the image's origin.
Does it verify the C2PA signature?
This is a presence check, not a cryptographic verification: Pixvisor does not validate the manifest's signature chain. An absent manifest also proves nothing: metadata is routinely stripped by social platforms and screenshots. For signature validation, use an official C2PA verifier; to see everything else a file contains, open the EXIF viewer or check for broader AI fingerprints with the AI image checker.
Which files can carry Content Credentials?
A manifest is not stored in EXIF or XMP. It has its own home, which is why most metadata viewers walk straight past it. In a JPEG it sits in the APP11 segment; in a PNG it sits in a chunk named caBX. Both are packaged as JUMBF, a container format for embedding structured boxes inside an image. Those are the two places this checker scans at the byte level, which is how it reports a manifest that never appears in a normal EXIF listing.
The practical consequence is that a manifest travels less well than people expect. Copying EXIF from one file to another does not carry it across. Converting to a format the tool does not support drops it. A screenshot removes it, because a screenshot is a new image with no relationship to the original file.
What a manifest proves, and what it does not
A valid manifest proves that the holder of a particular key signed a particular state of this file, and that the pixels have not changed since. That is genuinely useful, and it is narrower than most people read it as. It does not say the photograph is honest: a camera will sign a staged scene, a misleading crop, or a picture of a screen showing another image.
The reverse error is more common still. No manifest proves nothing at all. Most images on the internet carry none, because most software does not write one. Reading an absence as evidence of AI, or of a fake, gets the logic backwards. We explain both halves in what C2PA is.