C2PA is a technical standard for recording provenance information about digital media. The consumer-facing name for a C2PA manifest is usually Content Credentials. A credential can describe claims about how an asset was created or edited, the software involved, and the history that a signer chose to record. It is useful context when you need to understand a file, but it is not a shortcut to deciding whether every visible claim in an image is true.
An image file may contain ordinary metadata such as EXIF, XMP, IPTC, camera fields, and GPS coordinates. It may also contain C2PA-related data. The important distinction is that a full C2PA workflow uses a manifest, content bindings, and a signed claim. The C2PA specification defines validation states such as well-formed, valid, and trusted; those states require validation of the signed manifest and its relationship to the asset, not merely finding a label in file metadata.
What a browser-local metadata viewer can check
Image Metadata Viewer reads the selected file in your browser and reports common readable metadata. When it finds AI or C2PA-related indicators, that is a useful signal to investigate. You can see the general summary, inspect raw fields, and export a JSON record without uploading the file to this site.
For an image privacy workflow, this first pass answers practical questions:
- Does the file expose C2PA, XMP, EXIF, author, software, GPS, or camera-related fields?
- Is there a provenance-related field that the recipient should know about?
- Does the final file still contain the metadata you expected after an export or editing step?
- Should you preserve the original file and make a separate cleaned copy for sharing?
The result is intentionally limited to detection of readable fields. This viewer does not validate a C2PA signature, evaluate a signer trust chain, retrieve an external manifest, or prove that the pixels are authentic. A detected field is not a verdict. It is an invitation to use a dedicated validator when cryptographic provenance matters.
Detection, validation, and authenticity are different claims
These terms are easy to collapse, but they describe different work:
| Question | What the local viewer can do | What it cannot conclude |
|---|---|---|
| Is there readable C2PA or AI-related metadata? | Detect and show accessible indicators. | That a manifest is complete, signed, or trusted. |
| Does the credential still match the file? | Help you inspect the exact file you have. | Verify content bindings or cryptographic signatures. |
| Is the image authentic or free of AI editing? | Show metadata that may provide context. | Prove the origin, intent, or truthfulness of the image. |
This boundary matters for both privacy and accuracy. A file can have no readable C2PA data because the creator never added it, because an editing or sharing workflow removed it, or because the relevant data lives somewhere the viewer does not read. Conversely, the presence of a C2PA-related field does not replace a full validation result or human judgment about the content.
Why credentials disappear from files
Metadata is not guaranteed to survive every step between capture and publication. Re-exporting an image, taking a screenshot, copying pixels into a new document, converting formats, and platform processing can change or remove metadata. That is why a provenance review should use the exact file being evaluated, not a similar source image or a thumbnail downloaded from a website.
If you are preparing a public image, first inspect the final export. If you need an audit record, export JSON and keep the original privately. If you are only reducing privacy exposure, use the Metadata Remover for a supported format, then upload the cleaned copy again and inspect that output. Cleanup can remove metadata; it is not a way to preserve or cryptographically validate Content Credentials.
A practical C2PA review workflow
- Start with the original file whenever possible, because later exports may not retain the same metadata.
- Analyze it locally and review the AI/C2PA indicator together with author, software, camera, and raw metadata groups.
- Export JSON if you need a local record of what was readable at the time of review.
- For a high-stakes provenance decision, use a dedicated C2PA validator and read its validation status rather than relying on field detection alone.
- For a sharing decision, use the EXIF Privacy Checklist to decide which hidden fields should remain with the public copy.
Content Credentials can add useful provenance context, but they are only one part of an evidence-based review. Keep the difference between detection and validation clear, inspect the actual file, and avoid turning a metadata label into a claim the tool has not verified.
For technical detail on manifests, content bindings, signatures, and validation states, see the official C2PA specification.