Check Content Credentials before an asset ever leaves your workflow.
The Provenance Detection tool reads the C2PA manifest embedded in an image, video, PDF or audio file right in your browser — surfacing the provenance data designers, DAM managers and marketing teams need to publish with confidence.
Drop a file to inspect
We'll scan for an embedded C2PA / Content Credentials manifest and lay out what's inside it.
What to do with these results
Suggested actions change based on your role in the asset's lifecycle. Pick the one that matches yours.
Preserve the manifest on export
Export from Photoshop, Lightroom or Firefly with "Content Credentials" enabled so edits append to the manifest instead of stripping it.
Disclose AI-assisted steps
If any tool in your stack used generative fill or AI upscaling, confirm the digitalSourceType assertion reflects it accurately.
Re-check after every re-save
Re-run this validator after flattening, converting formats, or exporting for web — some pipelines silently drop C2PA data.
Tag provenance status on ingest
Store "manifest present / absent" and trust status as searchable custom fields so downstream teams can filter by it.
Set an ingestion policy
Decide whether licensed or client-supplied assets without a valid manifest get quarantined, watermark-checked, or routed for manual review.
Archive the original alongside renditions
Keep at least one unmodified, manifest-intact master — resized or recompressed renditions are the most common place credentials get lost.
Confirm compliance before paid placement
Meta, Google, TikTok and others increasingly require AI-disclosure labels — check the manifest's source type before an asset goes to media buying.
Keep the credentials pin visible
Don't route final assets through tools or CDNs that strip metadata; the "CR" badge is only useful to your audience if it survives publishing.
Log it for brand & legal review
Save the downloaded compliance report with the campaign record — it's the fastest way to answer "was this AI-generated?" months later.
Manifest inspection results
A structural read-out of the file's embedded provenance data, decoded entirely on-device.
File details
Content Credentials summary
IPTC / XMP rights & source metadata
Action history (c2pa.actions)
Manifest box structure (JUMBF) ›
Raw decoded manifest data ›
What the Provenance Detection tool actually checks
An honest description of the scope — this runs entirely in your browser and does not replace full cryptographic trust-list validation.
Locate the manifest
Scans JPEG APP11 segments, the PNG caBX chunk, a standalone .c2pa/JUMBF stream, or does a full-buffer box scan for TIFF, SVG and other containers.
Walk the JUMBF box tree
Parses the nested box structure to find the claim, assertion store, ingredients and signature boxes and their labels.
Decode CBOR / JSON / XMP
Converts binary assertion payloads (actions, hashes, generator, source type) and any embedded XMP packet into readable fields, including legacy IPTC-IIM in JPEG.
Flag what needs the official tool
Cryptographic signature and trust-list verification requires the C2PA trust anchors — we link out to contentcredentials.org/verify for that step.