The C2PA standard: one label any app can check.
C2PAC2PA: The Coalition for Content Provenance and Authenticity: the group that publishes the open standard for content labels. is a free, open standard for a signed label inside a file. The label shows who signed the work, what they declared, including AI use, and whether it changed.
Checking a label is free. No account needed.
- Who writes it
- The Coalition for Content Provenance and Authenticity, with 400+ member organizations.
- Latest version
- C2PA 2.4. Free to read and to build on.
- Text
- Encypher authored the C2PA standard for textC2PA text-provenance standard: The part of the C2PA standard that puts a signed label inside plain text, using invisible Unicode characters.. It was published on January 8, 2026.
- Who can check
- Any app that follows the standard. The check needs no call to the signer.
How a C2PA label works
- A tool signs the file and adds the label. The standard calls the label a C2PA manifestC2PA manifest: The signed label itself: a small package inside a file that records who signed it, what they declared and how to check it..
- The label travels inside the file, from app to app.
- A checker reads it and tests the seal. Apps show it as Content CredentialsContent Credentials: The public name for a C2PA label, often shown as a small CR icon that opens who signed the content and what they declared..
What a C2PA label shows, and what it does not
- Who signed
- The name on their X.509 certificateX.509 certificate: A digital ID card for a signing key: it names the holder and is itself signed by a certificate authority..
- What they declared
- The facts they chose to state. AI use goes in the digital source typeDigital source type: A field in the label that says how content was made: captured by a camera, made by AI, or a mix..
- If it changed
- A hard bindingHard binding: A hash of the content's signed bytes stored in the label, so a change to those bytes makes the check fail. breaks if a covered byte changes.
- What it does not show
- Whether the content is true, or who owns it.
C2PA for text
An article has no file box to hold a label. So the standard stores it in the text, as characters that draw nothing on screen. Copy and paste keeps it. Some tools strip hidden characters, so test your own path.
Encypher wrote this part of the standard. Erik Svilich co-chairs the C2PA Text ProvenanceText provenance: A signed label for text: who signed it, when, and whether the words changed. Task Force.
C2PA beside other methods
| Method | What you learn | The limit |
|---|---|---|
| C2PA label | Who signed, what they declared, and if it changed. | Some apps strip it. |
| WatermarkWatermark: A mark placed in the content itself, visible or hidden, so it can be found again after the file is copied. | A hidden mark, such as SynthIDSynthID: Google DeepMind's statistical watermark, added while a model generates content and read by Google's detector., that can outlast a strip. | It carries a few bits, not a full record. |
| FingerprintFingerprinting: Computing a compact summary of content and matching it against a database to find copies. | A match against a database of known files. | Someone must keep the database. |
| AI detectorAI detector: A model that guesses whether content was made by AI and returns a probability, not proof. | A guess that a model made it. | A score, never proof. |
Read C2PA and SynthID, or every comparison.
Who uses C2PA
- Cameras
- Leica, Nikon and Sony sign photos as they are taken.
- AI tools
- Adobe Firefly and OpenAI's image tools label what they make.
- Platforms
- LinkedIn and TikTok read the label and show it.
- Text
- Encypher signs articles and posts, down to the sentence.
C2PA and AI labeling laws
Article 50Article 50: The EU AI Act rule that AI-made content be marked in a form software can read, and deepfakes disclosed. of the EU AI ActEU AI Act: The European Union's law on artificial intelligence, which includes rules for marking AI-made content. asks AI providersProvider: Under the EU AI Act, the company that builds an AI system or puts it on the EU market under its own name. to mark their output in a way machines can read. It applies from August 2, 2026. Tools already on sale have until December 2, 2026.
A C2PA label is that kind of mark. California law asks for the same kind of record. Neither law names C2PA, so your counsel decides what each one needs.
Read the EU AI Act guide or the California guide.
Explore the C2PA standard
- Manifest structureThe parts of the label, box by box.
- Text standardHow a label rides inside plain text.
- FormatsThe 75+ formats we sign and check.
- ConformanceWhich tools passed the standard's test.
- Build with itSign and check files in one call.
- MembersWho writes the standard.
- C2PA and SynthIDA label and a watermark, side by side.
By industry: News Publishers, Academic Publishing, Music Industry, Government, Legal, Healthcare, Ad Tech, AI Companies.
Good questions
What does C2PA stand for?
Who founded C2PA?
How is C2PA different from the Content Authenticity Initiative?
Is C2PA free to use?
How does a C2PA label mark AI content?
For engineers
Show the technical detail
The four building blocks
- JUMBF
- The manifest store is a tree of JUMBF boxes (ISO/IEC 19566-5) placed where each format keeps extra data.
- CBOR claim
- The claim and its assertions are CBOR. The claim lists each assertion by URI and hash.
- COSE
- A COSE_Sign1 signature covers the claim. The protected header carries the x5chain.
- X.509
- Checkers walk the certificate chain to a root on the C2PA Trust List. An RFC 3161 timestamp shows when it was signed.
History and versions
- February 2021: C2PA founded by Adobe, Arm, BBC, Intel, Microsoft and Truepic.
- January 2022: C2PA 1.0 published.
- January 2024: C2PA 2.0 revises the claim (c2pa.claim.v2) and the trust model.
- January 8, 2026: C2PA 2.3 adds Section A.7, embedding manifests into unstructured text, authored by Encypher.
- Now: C2PA 2.4. The text method is Section A.8.
Full field names and examples are on the manifest structure page. Glossary: C2PA terms.