What is C2PA?

C2PA (Coalition for Content Provenance and Authenticity) is an open standard that embeds cryptographically signed metadata directly into media files. This metadata — called a manifest — records who created the content, what tools were used, and any edits made along the way. Major platforms like Adobe, Microsoft, and BBC are among the founding members of the C2PA specification.

The standard is designed to combat misinformation by giving viewers a verifiable chain of custody for images, videos, audio, and documents. When a file carries a valid C2PA manifest, you can check its provenance without relying on a third-party platform or watermark.

Tool description

This tool reads C2PA manifests embedded in media files and displays the full provenance metadata. Upload a supported file and it will extract the validation state (Trusted, Valid, or Invalid), claim generator, signer identity, signing algorithm, and the raw manifest JSON. You can also supply custom PEM trust anchors to validate signatures issued by a certificate authority not in the default trust list.

Supported formats

  • Images: JPEG, PNG, GIF, WebP, AVIF, HEIC, HEIF
  • Video: MP4, MOV
  • Audio: MP4 audio, MP3, WAV
  • Documents: PDF

How it works

The file is processed entirely in the browser using the official @contentauth/c2pa-web WebAssembly SDK. No file data is uploaded to a server. The SDK reads the embedded JUMBF (JPEG Universal Metadata Box Format) container, verifies the digital signature against a built-in or user-supplied trust store, and surfaces the manifest store as structured JSON.

Features

  • Displays validation state with clear trust indicators (Trusted, Valid, Invalid)
  • Shows signer identity including issuer, common name, algorithm, and signing time
  • Outputs the complete raw manifest JSON for inspection or debugging