Short answer: the signature can't realistically be forged, but the whole manifest can be deleted in about one second by anyone, using software they already have. Those two facts sound contradictory and they are not. C2PA is cryptographically sound and practically fragile at the same time, and understanding why is the difference between trusting Content Credentials correctly and trusting them blindly.
Can the cryptography be broken?
No, and this is the part C2PA gets right. A Content Credential is a manifest signed with a certificate from a recognized authority. Editing the pixels or the claims without re-signing invalidates the signature, and you cannot produce a valid signature without the private key. Nobody is forging an Adobe-signed or Leica-signed manifest by brute force. If a manifest validates, the claims inside it are genuinely from whoever the certificate says.
So can C2PA be faked?
Not by breaking the math — by working around it. The C2PA specification documents the threat models itself, and two matter in practice:
- Transplanting a valid manifest — an attacker can lift a legitimately signed manifest from one asset and attach it to another. The spec explicitly lists copying valid assertions, claims, or entire manifests between assets as a threat. Hard bindings (hashes of the content) are what stop this, which means the protection only holds where the binding is checked properly.
- Signing something true about something false — a credential proves who signed and what tool was used. It does not prove the depicted event happened. A perfectly valid Content Credential can be attached to a staged photograph. Provenance is not veracity.
Can C2PA be removed?
Yes, trivially, and this is the real problem. The manifest lives alongside the image data — typically in a JUMBF box in the file container — not inside the pixels. Anything that rewrites the file without C2PA awareness drops it:
- Uploading to most social platforms. Re-encoding on upload silently discards embedded credentials.
- Taking a screenshot. A screenshot is new pixels in a new file with no inherited metadata whatsoever.
- Opening and re-saving in a non-C2PA-aware editor, converting formats, or running a bulk resize script.
- Deliberately stripping it — a one-line command with common metadata tools.
Does C2PA use blockchain?
No. This comes up constantly and the answer is simply no. C2PA uses standard public-key cryptography — X.509 certificates and digital signatures — with a trust list of recognized issuers. There is no chain, no token, no distributed ledger. Some third-party services layer blockchain-based timestamping on top, but that is their addition, not the standard.
What C2PA does about all this: soft binding
The standard is not naive about the stripping problem. It defines soft bindings — watermarks or perceptual fingerprints that let a stripped file be matched back to its original manifest in a registry. In other words, C2PA's own architecture assumes a watermark exists underneath it to carry the identity when the metadata is gone. Soft binding is an active area of work rather than a solved guarantee, but the direction is unambiguous: the manifest is the record, and a pixel-level mark is how that record survives the open internet.
How to actually read a Content Credential
- Present and valid — strong evidence about origin and edit history. Trust it, within the limits above.
- Present and invalid — a real red flag. Something was altered after signing.
- Absent — proves nothing at all. Most authentic images on the internet have no credentials, and most stolen ones had theirs stripped on the first re-upload. Reading absence as a verdict is the single most common mistake people make with this technology.
What this means if you are protecting your own work
C2PA is worth using and it is not a theft defense. If your work travels through newsrooms, stock platforms, or other cooperating tools, sign it — the credential does real work there. If your work gets posted to Instagram, TikTok, or X, assume the manifest is gone the moment it lands, because it is. Theft is defined by the absence of cooperation, and C2PA is a cooperation protocol.
That is the gap a pixel-level watermark fills. It has nothing to strip because there is nothing traveling alongside the file — the signature is in the image data itself, spread redundantly across the frame. It carries far less information than a manifest (an identity signature, not a full edit history), but it is still there after the screenshot, the re-encode, and the re-upload. The two are complements, which is exactly what the soft-binding section of the spec says. We compared them in detail here.