Content Credentials are the consumer-facing name for C2PA, a standard that attaches a tamper-evident record of origin to a file. Cameras, Adobe apps and every large AI generator now write one. The record can state which tool created the asset, when, and which edits followed. The idea is that anyone downstream can ask a file where it came from - but almost no software surfaces that record, so in practice the data sits there unread.
What Actually Gets Embedded
A C2PA manifest is a JUMBF container carrying a signed claim. In a JPEG it rides in an APP11 segment, in a PNG in a caBX chunk, and in an MP4 or MOV in a top-level uuid box with a fixed identifier. Alongside it you will usually find an XMP packet with fields such as xmp:CreatorTool and the IPTC DigitalSourceType, which is set to trainedAlgorithmicMedia when the asset was generated by a model. Plain EXIF still matters too: a lot of tools simply write their name into the Software tag.
How This Page Reads Your File
The parser walks the container structure directly - JPEG segments, PNG chunks or ISOBMFF boxes - and reports where provenance data sits and how big it is. XMP is parsed into readable fields, EXIF is decoded from the TIFF header, and everything found is matched against a list of known generator fingerprints. Only the first part of the file is read, which is why a two-gigabyte video is inspected as fast as a thumbnail.
What a Result Does and Does Not Prove
Finding a manifest that says an image came from a model is strong evidence. Finding nothing is weak evidence of anything: metadata is removed by a screenshot, a re-encode, most social platforms and any metadata remover. This tool also stops short of verifying the signature on a manifest, which is what tells you the record has not been tampered with - for that, use the official Verify service. Treat the output as what a file discloses about itself, not as a verdict.