Skip to main content
Encypher Logo

Inside a C2PA manifest

A C2PA manifestC2PA manifest: The signed label itself: a small package inside a file that records who signed it, what they declared and how to check it. is the label stored in a file. It is a set of nested boxes: statements about the work, a hashHash: A short fingerprint of exact bytes. Any change, even one character, gives a completely different hash. of the file, and a signature that seals both.

See one in a real fileStart free
Inside a file, a JUMBF manifest store holds a manifest made of assertions, a claim that lists a hash of each assertion, and a signature with its certificate and timestamp; one assertion hashes the content bytes, which is the hard binding.
The file holds a manifest store. Each manifest holds a claim, its assertions, any ingredients, and a signature with a certificate and a timestamp.
Box
JUMBFJUMBF: JPEG Universal Metadata Box Format: the container that holds a C2PA label inside a media file., a standard way to nest data inside a file.
Statements
AssertionsAssertion: One statement inside a C2PA label, such as what was done to the content, whether AI was used, or the content's hash.: what the signer says happened, any creator details they supply, and any AI use they declare.
Link to the file
A hard bindingHard binding: A hash of the content's signed bytes stored in the label, so a change to those bytes makes the check fail., a hash of the file's bytes.
Seal
A COSE signatureCOSE: CBOR Object Signing and Encryption: the signature format C2PA uses to sign the claim inside a label. with the signer's X.509 certificateX.509 certificate: A digital ID card for a signing key: it names the holder and is itself signed by a certificate authority..

Boxes inside the file

In a JPEG, PNG, WebP or WAV file, the label is one tagged chunk or segment among the chunks that hold the picture or sound.
In a JPEG or PNG, the label is one tagged chunk beside the chunks that hold the picture.

Each format has a spot for extra data. A JPEG has one, an MP4 has one, a PDF has one. The manifest goes there, in a box called the manifest storeManifest store: The set of all manifests a file carries, one per signed version; the newest one is the active manifest..

A signer can add a new manifest when they sign an edit. They can keep the earlier labeled file as an ingredient. That keeps the history their tool chose to include. Labels can still be stripped along the way.

The claim ties it together

The claimClaim: The part of a C2PA manifest that lists every assertion by hash and is then signed, so no assertion can change unnoticed. is a short list. It names every assertion and gives a hash of each one. A hash is a short code that changes if a single byte changes.

The signature covers the claim. So if anyone edits an assertion, its hash no longer matches, and the check fails.

Assertions say what happened

Actions
Created, edited, published. AI use goes in the digital source typeDigital source type: A field in the label that says how content was made: captured by a camera, made by AI, or a mix..
File hash
The hard binding. It ties the label to the bytes the binding covers.
Details
MetadataMetadata: Data stored beside the content in a file, such as author, camera or date. Many tools strip it when they copy or upload a file. such as title, author and date.
Rights
Whether AI may train on the work.

Ingredients link earlier versions

Three versions of a paper, preprint, accepted manuscript and version of record, each with its own seal, linked back to the version it was made from.
A signer can list a file's sources, with their labels, so a checker can look back along the chain they kept.

A new file is often made from older ones. A cropped photo comes from a raw one. A page layout uses many photos.

A signer can list each source as an ingredientIngredient: A source file used to make new content, recorded in the new content's label with a link to its own label.. If the source had a label, it can be linked too. A checker can then look at the chain the signer kept. Steps no one recorded stay out of it.

The signature and the certificate

A checker trusts a signature when the signer's certificate was issued by a certificate authority on the C2PA Trust List, and trusts the timestamp when it comes from an authority on the C2PA TSA Trust List. The Conforming Products List shows the signing tool was tested.
The signature points to a certificate. The certificate points to an issuer on the C2PA Trust List.

The signer seals the claim with a private keyPublic key cryptography: Signing with a secret private key that only the signer holds, checked by anyone with the matching public key.. The seal carries their certificate, which names them.

The certificate links up a certificate chainCertificate chain: The links from a signer's certificate up to a root authority a checker already trusts. to an issuer. Checkers trust issuers on the C2PA Trust ListC2PA Trust List: The list of signing authorities that conforming C2PA checkers trust by default.. A timestamp authorityTimestamp authority: An outside service that signs the time a record existed, so a signature stays checkable after its certificate expires. adds the time of signing.

What a checker does

  1. Find the store.

    It reads the manifest store from the file.

  2. Test the seal.

    It checks the signature over the claim.

  3. Test the signer.

    It follows the certificate to a trusted issuer.

  4. Test the file.

    It hashes the bytes and compares them to the hard binding.

Four of the five answers a provenance check can give: Verified, Modified after signing, Issuer not recognized, and No provenance found. The fifth is Could not verify.
After its four tests, a checker gives one of four plain answers.

The result shows who signed, what they declared, and if the file changed. It does not say the content is true. Try the free checker.

For engineers

Show the technical detail

The JUMBF tree

  • Manifest store: a JUMBF superbox labeled c2pa (ISO/IEC 19566-5).
  • Manifest: one superbox per signing, labeled with a urn:c2pa: identifier. The last one is the active manifest.
  • Inside each manifest: the assertion store (c2pa.assertions), the claim (c2pa.claim.v2) and the claim signature (c2pa.signature).

The claim

A CBOR map. Key fields: claim_generator_info, instanceID, created_assertions and gathered_assertions (hashed URIs, one per assertion), signature (a URI to the c2pa.signature box) and alg. The signature covers the claim, and the claim covers each assertion by hash.

Assertion labels

c2pa.actions.v2
What happened: c2pa.created, c2pa.edited, c2pa.published. Each action can carry a digitalSourceType, such as the IPTC term trainedAlgorithmicMedia for AI output.
c2pa.hash.data
The hard binding for most files: a hash over the file's bytes, with the manifest's own byte range excluded. Video in ISO BMFF uses c2pa.hash.bmff.v3; box formats can use c2pa.hash.boxes.
c2pa.ingredient.v3
An earlier asset this one was made from, with its relationship (parentOf, componentOf or inputTo) and, if it had one, its own manifest.
c2pa.metadata / cawg.metadata
Descriptive metadata such as title and author, as JSON-LD.
c2pa.training-mining.v1
Machine-readable permissions for AI training, inference and data mining.
c2pa.soft-binding
A pointer to a watermark or fingerprint that can find the manifest again if it is stripped.

The signature

COSE_Sign1 (RFC 9052). The protected header carries the algorithm and the x5chain, the signer's X.509 chain. The unprotected header can carry an RFC 3161 timestamp (sigTst2) and stored revocation data. A checker builds the chain to a root it trusts, such as one on the C2PA Trust List, and checks the certificate was valid at the timestamp.

A verification result

{
  "valid": true,
  "signer": "Publisher Corp",
  "signed_at": "2026-03-15T14:23:00Z",
  "claim_generator": "Encypher",
  "assertions": [
    { "label": "c2pa.actions.v2",
      "data": { "actions": [ { "action": "c2pa.published" } ] } },
    { "label": "c2pa.hash.data", "match": true }
  ],
  "trust": "signer certificate chains to a C2PA Trust List root"
}

The field names above are a simplified example. The full schema is in the API reference.

Keep reading

Create. Mark. Endure.

Open the label on any signed file. It is free, with no account.

Check a fileStart signing free