C2PA Viewer
Select an image, video or audio file to read the C2PA Content Credentials it carries: the app or device that created it, who signed it, the recorded actions and whether AI generation is declared.
- Runs in your browser
- Free to use
About this tool
Content Credentials are becoming the standard way to say where a picture or clip comes from, and more and more files carry them, often invisibly. The C2PA Viewer reads the embedded manifest store from JPEG, PNG, WebP, HEIC, AVIF, MP4, MOV, WAV and .c2pa files, decodes the JUMBF and CBOR structures in your browser and shows a quick summary, the app or device, the signer, the issuer and any AI-generated declaration, followed by the complete decoded data you can copy or download as JSON.
Related: C2PA & AI Metadata Remover and the Image EXIF Viewer.
How to use it — quick steps
- 01
Add the file
Drop a photo, video or audio file on the dashed area, or choose it; large videos are scanned in chunks.
- 02
Read the summary
Whether credentials were found, the app or device used, who signed them, the issuer and any AI declaration.
- 03
Dig into the data
The full decoded manifest (claims, actions, ingredients, certificates) is listed below with copy and JSON.
Key features of this tool
Every common container
JPEG APP11 segments, PNG caBX chunks, WebP/RIFF chunks, ISO BMFF boxes (MP4, MOV, HEIC, AVIF) and standalone .c2pa manifest stores.
Fully decoded
JUMBF boxes, CBOR claims and signatures and the X.509 certificate chain are decoded locally into readable JSON.
Stays on your device
Files are parsed with the File API in your browser; nothing is uploaded and nothing is stored.
Frequently asked questions
What are Content Credentials?
The C2PA standard embeds a signed manifest describing how a file was created and edited: the software or camera, the actions performed, the ingredients used and, for AI tools, a "trained algorithmic media" source type. Adobe, OpenAI, Google, Microsoft, Leica and many others sign their output.
Does the viewer verify the signature?
No. It decodes the manifest and shows the certificate details, but does not validate signatures, hashes or the trust list; treat the result as what the file claims. Use c2patool or contentcredentials.org/verify for full validation.
Why does my photo have no credentials?
Most social networks, messaging apps and editors strip metadata on upload or export, so a missing manifest only means the copy you have was not signed, not that the original never was.
Can I remove the credentials?
Yes, with the C2PA & AI Metadata Remover.
Are my files or data uploaded?
No. The tool is plain JavaScript that runs in your browser; the files or data you provide here are never uploaded to our servers.