Content Credentials are signed records, defined by the C2PA standard, that describe who or what made a file and how it was edited. Google's Pixel 10 camera attaches them to every JPEG it captures, and they can include names, camera details and locations. This viewer reads them entirely offline: it checks the signature itself but does not fetch remote data, revocation status or the list of trusted signers.
What Content Credentials are
The Coalition for Content Provenance and Authenticity (C2PA) publishes an open standard for attaching a tamper-evident history to a photo, video or document. The record is called a manifest. Inside it are assertions (statements about the file, such as "captured with this camera" or "cropped in this app"), a claim that bundles them, and a digital signature over the claim. Each time a supporting app edits the file, it can add a new manifest that points back to the earlier one.
Support is spreading. Google says its Pixel Camera app attaches Content Credentials to any JPEG photo captured on Pixel 10, and that Google Photos adds them when such a photo is edited, with or without AI tools.
Why they matter for privacy
Content Credentials were designed to show where a file came from. That same history can include details about you:
- Names. The standard allows identity assertions and author fields. A creator can attach a name, an account or an organization.
- Camera and place details. The specification lets a signer copy EXIF fields, including GPS coordinates, into a signed assertion.
- Edit history. Actions such as "opened", "cropped" or "color adjusted", and which tools performed them.
- Ingredients. The files a composite was made from, sometimes listed by their original names.
- Titles. The C2PA security considerations note that title information placed in a claim cannot be redacted later.
Not every manifest carries all of this. Google, for example, describes its Pixel design as one where no image or group of images can be linked to one another or to the person who created them. The point is to look before you share, because you cannot know from the outside.
How to read a photo's Content Credentials
- Pick one JPEG, PNG, WebP or HEIC photo with Choose a file, or drag it in.
- If the file has no credentials, the page says "No Content Credentials were found in this file" straight away and loads nothing else.
- If credentials are present, the page loads its reader once (about 8.6 MB, served from this site; the status line shows the size) and opens the manifest.
- Read the summary: whether the signature checks out, then Title, Made with, Signed by, Signed at, Actions, Generative AI, Names, Camera and place details, and Made from.
- Scroll down for Earlier credentials if the file has been edited by more than one supporting app.
Why the viewer works offline, and what that means
C2PA allows a manifest to point to data stored on a remote server. The C2PA security considerations document warns that when a viewer fetches those resources, whoever hosts them can see which IP addresses viewed which files. A privacy tool should not create that trail, so this viewer turns off every network feature of its reader:
- it does not fetch remote manifests or other cloud data;
- it does not check whether a signing certificate has been revoked;
- it does not download the C2PA trust list of recognized signers.
As a result, the verdict "Signature checks out" means the signature is mathematically valid for this file and has not been altered since signing. It does not mean the signer is on a trusted list, which this page deliberately does not check. When the credentials have problems, the page says so and lists them.
What the viewer shows, field by field
| Field | Meaning |
|---|---|
| Signed by | The name in the signing certificate: a device maker, an app or an organization |
| Signed at | The time recorded with the signature |
| Made with | The software or device that created this manifest |
| Actions | What was done to the file, such as created, opened, edited or cropped |
| Generative AI | Shown when the manifest declares the file was made or changed with generative AI |
| Names | Author or identity names recorded in the manifest |
| Camera and place details | EXIF values the signer included, which can contain GPS coordinates |
| Made from | Ingredient files this one was built from |
Removing Content Credentials
The viewer is read-only. If the credentials contain a name or a place you do not want to share, the photo cleaners remove the whole C2PA block along with the rest of the metadata: use remove metadata from a photo for images and remove metadata from video for clips. Removing the credentials also removes the file's verifiable history, so the recipient can no longer check where it came from. Keep them when that history protects you, for example when you need to show a photo is your original work.
Where your file goes
The file is examined inside this browser tab. The first check, whether credentials exist at all, runs on your device. If the reader is needed, it comes from this site, and reading the manifest sends nothing anywhere. The file and the details found in it stay on your device and are gone once you close the page.
How the viewer is built
The page first looks for the C2PA container in the file's structure, which is quick and needs no extra code. Only when it finds one does it load the open-source C2PA web reader, compiled to WebAssembly, configured with its remote-manifest, revocation-check and trust-list features disabled. The reader validates the signature and returns the manifest store; the page then turns the assertions into the summary above. How the site loads extra code with integrity checks, and how you can verify that no request leaves your browser, is explained on the methodology page.
FAQ
My photo shows "No Content Credentials were found in this file". Is that certain?
It means no C2PA data is embedded in the file. A manifest stored only on a remote server would not be found, because the viewer does not go online to look.
Why doesn't the viewer say the credentials are "trusted"?
Trust depends on checking the signer against the C2PA trust list and revocation services online. This viewer stays offline, so it reports only that the signature itself is valid.
Can Content Credentials contain my location?
They can, if the device or app that signed them copied GPS data into the manifest. The Camera and place details row shows any such values.
Does the viewer change my file?
No. It reads the credentials and produces no output file.
Is the 8.6 MB reader downloaded every time?
No. It is loaded once when first needed, and only for files that actually contain credentials.
Will a cleaned photo still have Content Credentials?
No. The photo and video cleaners remove the C2PA block, so the cleaned copy has no credentials to show.
Sources
Checked 2026-10-11.
- Google: Pixel and Android trusted images with C2PA Content Credentials
- C2PA Technical Specification 2.4
- C2PA Security Considerations 2.4
- C2PA User Experience Guidance for Implementers
Last updated: