What Is C2PA and Content Credentials?
Open an image made or edited with a recent AI tool, camera, or Adobe app, and there's a decent chance it's carrying a Content Credential — a small signed record baked into the file describing where it came from. It's the human-facing name for C2PA (the Coalition for Content Provenance and Authenticity), a standard backed by Adobe, Microsoft, OpenAI, Google, several camera makers, and major news organizations.
What's actually in one
A Content Credential is a manifest — a block of metadata stored alongside the image, similar in spirit to EXIF or XMP but cryptographically signed. It can include the tool or app that created or edited the file, a timeline of edits, whether AI generation was involved, and a hash that lets a verifier check whether the pixels have been altered since the manifest was attached. It's not baked into the pixels themselves; it's a metadata record riding along with the file.
That distinction matters. A Content Credential is different from an invisible pixel-level watermark like Google's SynthID, which is encoded into the image data and designed to survive edits and recompression. A C2PA manifest is ordinary metadata — which means it can be stripped the same way EXIF or XMP can, the way we cover in removing metadata from photos. Worth knowing: the C2PA spec also allows for an optional "soft binding" watermark meant to help re-associate an image with its manifest if the metadata gets stripped or the file gets re-encoded — so removing the visible manifest isn't a guarantee that no trace of provenance survives anywhere.
Why you might want it gone
A Content Credential can broadcast more than you'd like a recipient to see — which app or AI model you used, your editing workflow, sometimes an organization name tied to the account that made the file. For personal photos, that's a fingerprint you didn't ask to share. For businesses, it can leak internal tooling choices. Either way, it's the same logic as GPS in EXIF data: information travels with the file whether you meant it to or not.
One honest caveat: removing a Content Credential doesn't change how an image was actually made — it only removes the disclosure. If a platform or publication requires you to label AI-generated or AI-edited content, do that separately; stripping the manifest isn't a substitute for following those rules.
How to remove it — locally
As with any metadata, don't hand the file to a random "watermark remover" website — that just moves the privacy problem to someone else's server. scrub reads and cleans the file on your own device:
- Drop the image inscrub inspects it locally, nothing uploads.
- See what's attachedIt flags C2PA/Content Credentials alongside any EXIF, XMP, or appended data it finds.
- Click CleanYou get a copy with the manifest and other metadata gone, pixels untouched, then a re-check to confirm it's clear.
The short version
Content Credentials are a signed metadata record, not an invisible watermark — so unlike a robust watermark baked into the pixels, scrub can remove it the same way it removes EXIF and XMP. Get scrub free and check a file before you send it.