Content Credentials are the first provenance tool a designer can switch on without changing how they work. Tick a box in Photoshop, export a JPEG, and the file carries a signed record of which tool made it, what was done to it, and whether an image generator was involved.
That is not the end of the "prove it is yours" problem. The record is only as good as the tool that wrote it, it vanishes at the first screenshot, and it says nothing about who owns the result. Knowing where it stops is what makes it useful in a fee conversation.
The short answer. Content Credentials are a cryptographically signed manifest, defined by the C2PA open standard, attached to a file at export. They record the tool, the edits, the ingredients and whether generative features were used. They can be stripped by screenshots and re-encoding, their absence proves nothing, and they record the software's claim, not a legal finding.
What Content Credentials are
Content Credentials is the public name for a technical standard written by the Coalition for Content Provenance and Authenticity, shortened to C2PA, a group that includes Adobe, Microsoft, the BBC and several camera makers. The Content Authenticity Initiative is the Adobe-led community that promotes adoption. All three names describe the same thing.
The mechanism is a manifest: structured data embedded in the file alongside the pixels. It holds assertions (what happened to the asset), a claim listing them, and a signature over the claim made with a certificate belonging to the exporting tool. A hash binds the manifest to the pixels; change one pixel after export and a verifier reports the credential as invalid. The specification and tooling are open, so a credential written by Photoshop can be read by software unrelated to Adobe.
What a C2PA manifest records
The manifest is not a diary of your process. It is a short list of facts the exporting tool will sign.
- Producer. Your name, if you choose to attach it, optionally backed by a connected social account or web domain.
- Tool and version. The application that exported the file.
- Actions. A coarse list: created, opened, edited, cropped, composited. Not your layers or your rejected directions.
- Generative use. Whether an AI tool was used and, in recent versions of the standard, whether the whole image or only part of it was generated. This is the flag clients ask about.
- Ingredients. Files placed into this one, each with its own manifest if it had one.
How it is attached and how anyone verifies it
In Photoshop, Content Credentials live in a panel of the same name. Adobe's Content Credentials help page has the current steps: enable the feature once in preferences, choose what to include, then export as normal to JPEG or PNG. Adobe's own image generator attaches a credential automatically to anything it produces, which is where the generative flag on a client's mockup usually comes from.
Figma, Sketch and Affinity do not write C2PA manifests at export as of this writing. If your pipeline ends in one of those, bring the final export into Photoshop for the signing step, or sign the file with the C2PA project's open-source command-line tool and your own certificate. Either way the credential records only what the exporting tool can see, not the sketchbook or the fourteen killed directions, which is why it sits alongside the process record in how to prove a design is yours instead of replacing it.
Verification is the easy part. The Content Authenticity Initiative runs a public Verify page where anyone can drop a file and read the manifest: producer, tool, actions, generative flag, ingredients, signature status. The proof travels with the file instead of being argued about later.
The final files are attached. Each one carries Content Credentials, which you can check by dropping the file on contentcredentials.org/verify. The record shows the file was exported from our studio in Photoshop, lists the edits, and confirms no generative tools were used in the final artwork.
Send this with every final delivery that carries a credential; it teaches the client to expect one.
What Content Credentials prove and what they do not
Most arguments about provenance metadata come from reading the left column and assuming the middle one.
| Claim | Does a valid credential prove it? | Why, and where it fails |
|---|---|---|
| This exact file was exported from a named tool, unaltered since | Yes | The tool signs the manifest and the hash binds it to the pixels. Any edit or re-save breaks it. |
| A specific person made it | Only with a verified identity attached | An unverified name is free text. A connected account ties the file to an account, not a hand. |
| Generative tools were, or were not, used | Yes, as far as the exporting tool could see | A generated image opened as a flat JPEG with no manifest of its own shows as an ordinary ingredient. |
| A file without a credential was generated or copied | No | Absence proves nothing. Most tools write no manifests and most platforms strip them. |
| Who owns the copyright | No | The manifest records provenance, not ownership. |
| A court would accept it as authorship | No | It is evidence a tool produced. Its weight is for the court. |
Three things strip a credential, and clients will hit all of them. A screenshot is a new image with no manifest. Re-encoding by an image optimiser, a CMS pipeline or a messaging app produces new bytes and the manifest is gone. Many social platforms strip metadata on upload; a few now preserve Content Credentials, the list changes monthly, so test before promising a client the badge will survive.
On the last two rows: the US Copyright Office has said that material produced by a generative tool without sufficient human authorship is not registrable, and it decides that on the work itself, not on metadata; its 2023 registration guidance is the document to read. A credential saying "no generative tools used" supports your position without settling it. The same applies to AI-generated logos, where the flag is a reason to ask who owns the file, not an answer.
Why this matters for the fee conversation
For this site's argument, Content Credentials matter for a simple reason: they are the cheapest way to show a client the work happened in your studio, before anyone asks.
The unpaid pitch has changed shape. The client who once asked three studios for free concepts now arrives with a generated mockup and asks you to "make it real" at a fraction of the fee, a pattern covered in the mockup that arrives before the brief. Drop that mockup on the verify page. If the generative flag is set, you hold a neutral record of what the file is, and a talking point: this took a generator seconds, and the fee covers everything the generator cannot do. The scoping and pricing arguments for generated inputs get easier when the input labels itself.
It also gives you something concrete for the contract. A clause promising that final files will carry Content Credentials with the generative flag reported honestly is a promise the client can check. The wording belongs with the disclosure language in design contracts; the rates and scope pillar covers pricing the process record behind it. The proof is delivered at handover. What happens to the file afterwards is the client's problem, now in writing.
Export checklist
Once per delivery. It takes less time than writing the email.
- Turn on Content Credentials in Photoshop preferences and confirm the panel shows your name and a connected account or domain.
- Place ingredients as files, not pasted pixels, so their own manifests travel into the composite.
- Check the generative flag before export. If a generator touched any layer, the flag should be set and your note should say so.
- Archive the export next to the version history and process files, with its SHA-256 hash in the delivery note, and send the note above.
- If the client will publish on a platform that strips metadata, say so, so a missing badge later is expected.
Frequently asked questions
Are Content Credentials and C2PA the same thing?
Nearly. C2PA is the open technical specification: the manifest format, the assertions, the signing and binding rules. Content Credentials is the consumer-facing name Adobe and the Content Authenticity Initiative use for an implementation of it. A client asking whether your file "has C2PA" means the same thing as asking for Content Credentials.
Can I add Content Credentials to a Figma export?
Not from Figma directly at the time of writing. Export the final PNG or JPEG, open it in Photoshop with Content Credentials enabled, and re-export; the manifest records Photoshop as the exporting tool and the Figma export as an ingredient without its own credential. Or sign the file with the C2PA command-line tool and your own certificate.
Does a credential prove I own the copyright?
No. It records provenance: which tool, which edits, which ingredients, and whether generative features were used. Ownership is decided by your contract and by copyright law. A credential showing no generative use is useful evidence of human authorship, but the Copyright Office and the courts judge the work itself, not the metadata.
Can Content Credentials be faked?
Forging a valid Adobe-signed manifest is not practical; the signature is checked against the signing tool's certificate. What can happen is misleading truth: a generated image opened as a flat file and edited by hand carries a credential reporting the edits and no generative use, because the tool never saw the generator. Read the ingredients, not just the badge.
What to do this week
Turn Content Credentials on, run one real delivery through the checklist, and read the manifest on the verify page as the client would. Once that is habit, whether the work was made in your studio is answered before it is asked.
The credential is one layer of a larger record. The Proof of Work hub covers the process files that carry the weight the manifest cannot, starting with version history as the design record.