Guide · TagWipe

What Is C2PA / Content Credentials? The Reddit Questions, Answered

Didactic Initiatives · Updated August 4, 2026 · 7 min read

C2PA threads on Reddit tend to run hot. In r/photography it's a professional problem — credentials nobody asked for, attached on export, triggering AI labels on real work. In r/privacy it's read as tracking infrastructure. In r/StableDiffusion it's an obstacle. And in almost all of them, someone confidently states that C2PA is a watermark, which is the single most consequential misunderstanding in the whole topic.

It isn't a watermark. Here's what it actually is.

The short definition

C2PA is the Coalition for Content Provenance and Authenticity — an industry standard for recording how a piece of media was made and edited. Content Credentials is the consumer-facing brand name for the same thing; you'll see both used interchangeably, which is part of why the threads get confused.

Concretely, it's a cryptographically signed manifest embedded in your file. A typical manifest can record:

• The device or software that created the image.
• Each editing step, and which tool performed it — including whether a step was generative.
• A digital signature from the issuing tool, so tampering with the manifest is detectable.
• Optionally an identity or organisation, where the creator opted in.

The purpose is genuinely reasonable: give a news photo a verifiable chain of custody, so a real image can prove it's real. The friction is that the same machinery attaches to a snapshot you edited on your phone, and platforms read it to apply labels automatically.

The Reddit misconceptions, sorted out

❌ "C2PA is a watermark"

The important one. C2PA is metadata — a block of data stored alongside the compressed image, in the same neighbourhood as EXIF. Remove the block and the pixels are bit-for-bit unchanged.

An invisible watermark like Google's SynthID is the opposite: a signal encoded into the pixel values themselves, designed to survive cropping, recompression and screenshots. No metadata tool can remove it, because there's no metadata to remove.

Why this distinction matters: it's the difference between "removable in a second, losslessly" and "not removable at all." Conflating them leads people to either give up on something easy, or trust a strip that didn't cover what they thought.

❌ "It's spyware / it phones home"

The manifest is embedded data, not a beacon. Reading it doesn't contact anyone. Two real caveats behind the fear: some manifests link to a cloud record with a fuller edit history, and a manifest can carry creator identity if that was enabled. So it's not tracking, but it is more disclosure than most people realise they're attaching — and "I didn't know this was in my file" is a legitimate complaint even when "it's surveillance" isn't accurate.

❌ "Stripping it is illegal / marks you as a forger"

Two claims worth separating. On legality: removing metadata from your own file isn't illegal in general, and the C2PA specification explicitly anticipates credentials being lost in ordinary use — screenshots, format conversions and platform pipelines destroy them constantly. Stripping is an expected event, not an attack on the system.

On suspicion: a verifier can tell credentials are absent, but absence is the default state of essentially every image on the internet. What looks suspicious is a manifest that's present and invalid — a broken signature — not one that was never there.

The honest caveat the careful commenters raise: context matters. Stripping provenance and then making a false claim about how an image was made can breach platform policy, and in journalism, competition or legal contexts it can be seriously misleading. The technical act is neutral; what you say afterwards isn't.

✅ "You can turn it off in Adobe's settings"

Correct, and the most useful practical tip in these threads. Adobe apps expose a Content Credentials preference you can disable so new exports don't get a manifest attached. It won't clean files you already exported, and it doesn't stop the separate IPTC DigitalSourceType field that generative features write — which is enough on its own to trigger an Instagram AI label.

Which tools attach credentials

How to see whether a photo has credentials

Adobe's Content Credentials Verify site will inspect a file you upload and show any manifest it finds — useful once, though it means handing your image to a web service. On iPhone, TagWipe scans locally and lists what's present without the file leaving the device. Either way, checking first is worth it: people are often surprised by which of their photos carry a manifest and which don't. More on that in reading a photo's hidden metadata.

How to remove Content Credentials

Because it's metadata, removal is lossless and quick:

1. On iPhone — open TagWipe, select the photo or batch, review the scan, and clean. C2PA manifests, IPTC and XMP provenance fields, Apple's Clean Up credit and ordinary GPS/device EXIF all go in one pass, on-device.
2. On a computer — exiftool -all= photo.jpg clears the metadata blocks. Verify the result rather than assuming, particularly for Apple-specific fields.
3. Prevent it — disable Content Credentials in Adobe's preferences so future exports aren't tagged.

What removal doesn't do: it doesn't touch invisible pixel watermarks, and it doesn't stop a platform's own classifier from guessing. If a tag made the decision, removing the tag fixes it. If the image itself is the evidence, no metadata tool is relevant.