Where is the Content Credentials verify tool?

At verify.contentauthenticity.org. The older address, contentcredentials.org/verify, now redirects there.

Why does a photo from a news site show no credentials?

Usually because the copy you have is not the original file. Content management systems, social platforms and messaging apps often re-encode images and drop metadata, which removes the manifest. Ask for the file as published, or the original.

Can someone fake content credentials?

Anyone can sign a manifest with their own certificate, so a credential is only as trustworthy as its signer. What is hard to fake is a valid signature from a certificate on a recognised trust list; that is the difference between a Valid and a Trusted result.

Do content credentials show whether an image was made with AI?

Only if the tool that made it said so. A C2PA manifest records a digital source type when an asset is created, and generators that sign their output use it to declare AI generation. An image without a credential carries no such statement.

Is uploading an image to a verify tool private?

Check the tool's own privacy terms before uploading anything sensitive. For confidential files, read the manifest locally with c2patool instead, which never sends the file anywhere.

How to check content credentials on any image, no command line needed

The Implbits editorsPublished 2026-10-31Updated October 31, 20265 min read

Applies toWindows, macOS and Linux

Flat geometric drawing of a photo carrying a seal, beside a list of recorded edits. — A content credential, read without a command line.

Short answer

To check content credentials, open the Content Credentials Verify page in a browser and give it the original image file. If the file carries a C2PA manifest, the tool reads who signed it, which tools made or edited it, and whether it validates. No credentials is common and proves nothing about the image either way.

Content credentials are a signed record that some cameras, editing apps and AI image generators attach to an image: who made it, with what, and what was changed. You can check them in a browser in under a minute, without installing anything. This guide shows how, and how to read each kind of result, including the most common one, which is "nothing found".

It is part of our step-by-step guides to verifying content, and it sits near the top of the evidence ladder those guides use. A valid, signed credential is among the strongest evidence an image can carry. A missing one is among the weakest signals there is, because most images in circulation have none.

What you need

The image file itself, as close to the original as you can get. A copy saved from a chat app or a screenshot will usually have lost its credentials.
A desktop or mobile browser.
Optional: c2patool, if you want the full record with every validation code.

Step 1: Get the original file

This step decides most outcomes. Content credentials live inside the file as a C2PA manifest, and many services re-encode uploads and discard embedded data. If you can, download the image from the publisher's own page, ask the sender for the original, or use the export the camera or app produced.

Keep an untouched copy before you do anything else. If you open the image in an editor and save it, you may destroy the very record you want to read.

Step 2: Open the image in a credentials viewer

Go to Content Credentials Verify, the browser viewer from the Content Authenticity Initiative. The older address, contentcredentials.org/verify, redirects there. Add your image file to the page. The tool reads any C2PA manifest it finds and shows a summary.

Viewers present their results in their own layout, and layouts get redesigned, so rather than follow a picture of one, read the result against the four questions below. If you prefer a fixed, text-based record you can save, read the manifest with c2patool instead; it reports the same underlying fields as raw JSON.

What a credential can tell you

A C2PA manifest can record four kinds of information. Look for each in the result.

Who signed it. The organisation or person named on the signing certificate. This is the party vouching for the record. A camera maker, a news organisation or an AI service are typical signers.
What made it. The app, device or generator that created the file, recorded as the claim generator, and how the asset came to exist. Generators that sign their output can declare here that an image was created by AI.
What changed it. The actions applied: cropping, colour adjustment, drawing, and so on, as stated by the signing software. If several C2PA-aware tools touched the file, you may see a chain of earlier versions, called ingredients.
Whether it checks out. The validation result, which the next section explains.

Hardware is part of this now. Leica lists several cameras with Content Credentials built in, among them the M11-P, M11-D, SL3-P, SL3-S, Q3 Monochrom and M EV1 (Leica Camera, Content Credentials). A photo straight from one of those cameras can carry a signed record from the moment of capture.

How to read the validation result

The C2PA specification defines three states for a manifest (C2PA 2.5, validation states). Viewers word them differently, but the meaning is the same.

State	What it means	What to do next
Trusted	Valid, and the signer's certificate is on a recognised trust list	Treat the record as strong evidence of origin and history
Valid	Unchanged since signing and correctly signed, but the signer is not on the tool's trust list	The record is intact; decide separately whether you trust the signer
Well-formed only, or an error	The structure is fine but a signature or hash check failed	Treat the content as changed since signing

A trusted result does not mean the picture shows something true. It means a known party stands behind the record and the file has not changed since they signed it.

If there are no credentials

This is the most common result, and it is not a red flag. Most cameras and apps do not yet attach content credentials, and many sharing services strip them. A missing credential tells you nothing about whether the image is genuine, edited or generated.

In our own run with c2patool, re-saving a credentialed sample image with metadata stripped turned a readable manifest into "No claim found". One ordinary save was enough.

The C2PA specification anticipates this. It describes soft bindings, a fingerprint or an invisible watermark, as a way to find the original manifest in a repository "if a C2PA manifest is removed from an asset" (C2PA 2.5, soft bindings). Whether that recovery works depends on the signer having registered the content somewhere a viewer can search.

When nothing is found, move down the ladder: read the image's metadata for capture details or an AI source label, then search for earlier copies.

If the credentials are invalid

An invalid result means the record and the file no longer agree. The common cause is innocent: someone edited or re-encoded the image with software that kept the old manifest but did not write a new one, so the content hash no longer matches. In a c2patool run, this shows up as the code assertion.dataHash.mismatch.

It can also mean deliberate tampering. You cannot tell which from the result alone. What you can say is that the credential no longer describes this file, so it cannot be used as evidence for it. Look for an earlier copy whose credential still validates.

Where this check sits on the evidence ladder

From strongest to weakest, the checks for an image rank like this:

Trusted content credential with a matching hash: proves the file is unchanged since a known signer vouched for it. Cannot prove the content is true.
Valid but untrusted credential: proves the file is unchanged since signing. Cannot tell you who the signer really is.
Metadata and AI source labels: show what the last program recorded. Easy to edit or strip.
Invisible watermarks: show that a participating generator marked the image. Silent about everything else.
Visual tells and detector scores: estimates only.

For a full walk down that ladder on one suspect picture, use the checklist for deciding whether an image is AI-generated.

Sources

Questions

Where is the Content Credentials verify tool?
At verify.contentauthenticity.org. The older address, contentcredentials.org/verify, now redirects there.
Why does a photo from a news site show no credentials?
Usually because the copy you have is not the original file. Content management systems, social platforms and messaging apps often re-encode images and drop metadata, which removes the manifest. Ask for the file as published, or the original.
Can someone fake content credentials?
Anyone can sign a manifest with their own certificate, so a credential is only as trustworthy as its signer. What is hard to fake is a valid signature from a certificate on a recognised trust list; that is the difference between a Valid and a Trusted result.
Do content credentials show whether an image was made with AI?
Only if the tool that made it said so. A C2PA manifest records a digital source type when an asset is created, and generators that sign their output use it to declare AI generation. An image without a credential carries no such statement.
Is uploading an image to a verify tool private?
Check the tool's own privacy terms before uploading anything sensitive. For confidential files, read the manifest locally with c2patool instead, which never sends the file anywhere.