WHAT CONTENT CREDENTIALS SAY ABOUT YOU
Content Credentials are the new label on the tin. Adobe writes them, OpenAI writes them, Google put them in the Pixel camera, and TikTok asks for them on realistic AI content. The idea is decent: a file should be able to prove where it came from.
The part nobody puts on the poster is that "where it came from" often means "who you are".
What is actually in one
A Content Credential, or C2PA manifest, is a cryptographically signed record that travels inside the file. Drop a signed image into MetaStrip and you will see what it says, because the manifest is read rather than just detected:
- The tool that made it. Firefly, a specific Photoshop version, a camera model, or a library like c2pa-rs with its version number.
- An origin claim. This is the interesting one. It says whether the file was captured by a camera, created in software, or generated by a trained model. It is how "made by AI" gets asserted.
- The signing certificate. Certificates carry a common name in the clear, which can be a company or a person.
- A named author, when a schema.org assertion was attached.
- The edit history: created, opened, cropped, resized, filtered, redacted, published.
- Ingredients. How many earlier files went into this one, because a manifest records what it was built from.
Put together, that is a small provenance dossier riding along with every copy you send. The World Privacy Forum has made the obvious point about it: once identity data is inside a manifest and the file is out in the world, you cannot pull it back out of the copies.
Where it hides, format by format
This is why so many tools that claim to remove metadata leave Content Credentials completely intact. The manifest lives in a JUMBF container, and every format carries that container in its own private corner:
- JPEG: APP11 marker segments. A manifest bigger than 64 KB is split across several of them.
- PNG: a
caBXchunk, which is not one of the chunks a normal cleaner drops. - MP4 and HEIF: a top-level
uuidbox stamped with the C2PA identifier, which sits outsidemoovwhere most parsers never look. - TIFF and DNG: an IFD tag.
If a tool only knows about EXIF and XMP, it will strip your camera model, report success, and hand you back a file that still says who signed it.
Removing it is a trade, and you should know both sides
There are honest reasons to remove a Content Credential. You are a source sending a photograph to a journalist. You are selling something and do not want the buyer to know which Creative Cloud account edited the listing photo. You generated an image and do not want the model named. You are simply not interested in shipping an identity assertion to strangers.
There is also a real cost. The manifest is what lets someone else verify the file has not been tampered with since it was signed. Remove it and the file no longer proves anything about itself. That is not a reason to keep it, but it is a reason to make the choice deliberately, which is why MetaStrip shows you the claim first and puts the removal behind a tick box you control.
How MetaStrip removes it
In a JPEG or PNG the whole segment or chunk is cut out, because nothing in either format points into it. In an MP4 the box keeps its size and becomes a free box with a blank payload, since a video's chunk tables store absolute file offsets and moving a single byte would desynchronise playback. Either way the picture and the audio are untouched, and the file stays the file you started with.
One more thing worth knowing: a Content Credential is not the same as a watermark. Some AI tools also embed an invisible watermark in the pixels themselves. Removing metadata does nothing about that, and any tool telling you otherwise is guessing.