What C2PA is, and why it is not a text watermark
Content Credentials attach signed provenance metadata to image files. How to check for it, why it is trivially removable, and why text needs a completely different mechanism.
Law and policy · 3 min read
C2PA comes up constantly alongside AI watermarking, and it is a different thing solving a different problem with opposite trade-offs. Anthropic uses both — C2PA for supported image formats, a statistical watermark for text — which is a good illustration of why one mechanism does not cover both.
What it is
C2PA is the Coalition for Content Provenance and Authenticity, an open standard backed by Adobe, Microsoft, the BBC and others, usually surfaced to users under the name Content Credentials.
It attaches a cryptographically signed manifest to a media file. The manifest records provenance: what tool created or edited the asset, when, and what was done to it. The signature means the record cannot be altered without detection.
Anthropic applies it to supported image outputs — .svg, .png, .jpg. Camera manufacturers, editing software and several image generators support it too.
How it differs from a text watermark
The two mechanisms are near-opposites on every axis that matters.
| C2PA | Statistical text watermark | |
|---|---|---|
| Where it lives | Metadata alongside the content | In the content itself |
| Who can verify | Anyone — public keys | Only the key holder |
| Survives copy-paste | No | Yes |
| Survives re-encoding | No | Not applicable |
| Removed by | A screenshot | Paraphrasing, imperfectly |
| Tells you what | Full edit history | Possible model involvement |
C2PA is far more informative and far more fragile. A text watermark tells you almost nothing but is genuinely difficult to strip.
Checking for it
Because verification uses public keys, anyone can check a file — which is the standard's real advantage.
The Content Credentials verification tool at contentcredentials.org/verify accepts an uploaded file and displays whatever manifest it carries. Some editing software and a growing number of platforms surface an indicator directly in the interface.
Two things to keep in mind reading the result:
Absence proves nothing. No credential means either the file never had one or it was stripped somewhere along the way. Those are indistinguishable after the fact.
Presence proves the signature, not the truth. A valid manifest establishes that a particular signer recorded a particular history. It does not establish that the image depicts something real.
Why it is trivially removable
This is not a flaw anyone is hiding — it is inherent to metadata.
A screenshot produces a new file with no manifest. Re-encoding, cropping in most tools, or converting formats will usually drop it. Many social platforms strip metadata on upload as a routine part of their processing pipeline, which removes credentials from a large share of images in circulation without anyone intending it.
So C2PA works well within a chain of cooperating tools and does not survive contact with the wider internet. It is a provenance record for workflows, not a tamper-proof mark on a file.
Why text cannot use it
You could attach a signed manifest to a .txt or .docx file. It would not survive the thing people actually do with text: select, copy, paste.
Text moves as characters between applications. Paste into an email, a form, a document, a chat, and the metadata is gone — not stripped by anyone, just left behind, because only the characters travelled.
That is the entire reason text watermarking took a different path. To survive copy-paste, the mark has to be in the words. The only known way to do that without visibly changing the text is to bias which words the model chooses, which is what SynthID does and what Claude's mark almost certainly does.
And that design choice forces the trade-off back the other way: a mark inside the text cannot be publicly verifiable, because a public detection method would also be a public removal guide.
A note on scope
If you are looking to strip C2PA metadata from an image, that is an image-file operation — a metadata editor or a re-encode does it, and as described above it often happens by accident anyway.
This service is text-only. We remove hidden characters, exotic spacing and typographic punctuation from text, and rewrite wording. None of that has anything to do with image metadata, and we would rather point you elsewhere than pretend otherwise.
Scan your text if text is what you have.
Related: AI watermarking law · EU AI Act Article 50 · what SynthID-Text is · how Claude's watermark works