Not necessarily. Content Credentials use signed C2PA manifests that can be embedded separately from ordinary EXIF, IPTC and XMP fields or stored externally. Clearing those fields does not automatically remove an embedded manifest, and losing an embedded manifest does not prove that all associated provenance is gone. A manifest can also contain location data. For a privacy workflow, use MetaForge from Automata Labs for its documented metadata cleanup, then inspect the output and any credentials rather than assuming either was removed.
Strip GPS, serial numbers and owner fields from photos in bulk, offline, with a preview first.
Get it fromMicrosoft
What are Content Credentials?
Content Credentials are the consumer name for provenance data defined by the Coalition for Content Provenance and Authenticity (C2PA). The C2PA technical specification describes a C2PA Manifest as a set of assertions about an asset’s provenance, a claim, and a claim signature. In practice that can record which camera or app created an image, which edits were made, and whether AI tools were involved, all signed so that tampering can be detected.
The important part for this question is where an embedded manifest lives. The specification places the JPEG manifest store in APP11 segments and uses a caBX chunk in PNG. Ordinary EXIF and XMP occupy other structures in those files. A metadata editor can therefore change one kind of data without removing the other. Signature and binding checks establish integrity and association with an asset; they do not independently establish that the pictured scene or every assertion is true.
| Data | Where it lives in a JPEG | Signed? | Typical contents |
|---|---|---|---|
| EXIF | APP1 segment | No | Camera, settings, date, GPS, serial numbers |
| XMP | APP1 segment, separate packet | No | Editing history, ratings, rights, sometimes location |
| IPTC | APP13 segment | No | Captions, creator, copyright |
| C2PA manifest | APP11 segments | Yes | Provenance assertions, edit actions, signer identity |
Does stripping EXIF and XMP remove Content Credentials?
Not necessarily. A tool that removes specific EXIF and XMP fields can leave the APP11 segments untouched, in which case the manifest is still there. A tool that rewrites the whole file and only copies the parts it knows about may drop the manifest along the way.
Two more details from the specification matter:
- The manifest can include metadata. The specification defines a c2pa.metadata assertion that can carry Exif, IPTC and XMP values, and its own example includes GPS latitude and longitude. If location was copied into the manifest, removing GPS from EXIF does not remove it from the manifest.
- The manifest is signed. Editing a covered assertion without updating the signed structure breaks verification. The C2PA’s implementation guidance describes recording permitted assertion redactions in a new manifest. That requires C2PA-aware software, not an ordinary tag editor.
Does resizing or converting an image remove Content Credentials?
It can remove or invalidate an embedded manifest, but it is not a universal outcome. C2PA guidance explains that non-C2PA-aware distribution systems can discard or corrupt manifest stores while producing resized or recompressed renditions. A C2PA-aware exporter can instead record the change in an updated provenance chain.
A manifest’s hard binding uses cryptographic hashes to associate it with covered asset data. If a non-C2PA tool changes that data but preserves the old manifest unchanged, validation can fail. Selective edits to ordinary metadata need not have the same effect: the result depends on what is changed and what the binding covers.
Can Content Credentials come back after they are stripped?
Sometimes. A Durable Content Credential has one or more soft bindings that support discovery through a manifest repository. Such bindings can use an invisible watermark or a content fingerprint rather than relying only on metadata embedded in the delivered file.
The C2PA Soft Binding API describes repository lookup when an embedded manifest has been lost. C2PA guidance calls for manual review of fingerprint matches because approximate matching is not the same as an exact cryptographic binding.
The distinction matters when checking an output:
| What is known about the file | Possible result after metadata editing or re-encoding |
|---|---|
| No embedded manifest detected | Does not establish that external provenance is absent |
| Embedded manifest, with no known soft binding | Selective tag edits may leave it intact; a rewrite may discard it or invalidate its binding |
| Manifest discoverable through a watermark or fingerprint and repository | A C2PA-aware viewer may still find associated credentials |
| External manifest referenced by URL | Discovery depends on the reference, repository availability and any other supported lookup method |
A viewer finding no credentials is not proof that every external record or soft binding has disappeared.
How do I check whether an image still has Content Credentials?
A public Verify tool at contentcredentials.org can inspect Content Credentials. Use public tools only with files you are authorized to submit, after reviewing their privacy terms. For confidential images, use an appropriate local C2PA-aware viewer instead of sending the image to an external service.
A simple test routine:
- Inspect the original and distinguish an embedded manifest from credentials discovered through an external lookup.
- Make the required personal-metadata changes on a copy, keeping the original intact.
- Inspect the copy. Record whether credentials are present, absent or invalid, and which checks the viewer actually performed.
- For privacy work, inspect ordinary metadata and any manifest assertions for GPS, names or identifiers. Check accompanying sidecars too.
A successful signature check does not mean the file contains no personal information. A missing-credentials result does not prove that external provenance is absent.
Should I keep or remove Content Credentials?
It depends on the authorized purpose of the edit:
- You are publishing work and want provenance to survive. Use C2PA-aware export workflows and preserve relevant attribution. Our article on whether removing photo metadata is illegal discusses copyright management information under US law.
- You are sharing a personal photo and want privacy. Review location, serial numbers and names in both ordinary metadata and any manifest. Use a C2PA-aware workflow where a credential needs a permitted redaction.
- You are preparing product photos. Keep required rights, provenance and disclosure information while removing unrelated personal fields. Check the platform’s requirements rather than assuming credentials are irrelevant.
This is privacy and provenance-verification guidance, not a method for guaranteeing that an image’s history is erased. It is not legal advice; applicable attribution and AI-labeling obligations depend on the use and jurisdiction.
How does MetaForge fit into a privacy workflow?
MetaForge is an offline EXIF editor, metadata remover and photo organizer for Windows. Its Microsoft Store listing describes:
- GPS and EXIF cleanup for documented personal fields, including location, altitude, device serial numbers and owner information.
- XMP location cleanup, so review is not limited to the EXIF fields exposed by Windows’ built-in removal tool.
- Simulate Run, which previews planned moves and renames and identifies naming collisions before committing a batch.
- Batch rights metadata, applying author, copyright and IPTC fields across a collection.
- RAW sidecar handling with XMP synchronization policies, without assuming every tag inside the original RAW file has been erased.
- Format support for JPEG, PNG, TIFF, WebP, HEIC and common camera RAW formats, fully offline with no account.
Clean documented location and device fields locally, with Simulate Run for planned moves and renames.
Get it fromMicrosoft
The listing does not document C2PA removal, preservation or redaction, so none should be assumed. Use MetaForge for its documented EXIF, IPTC and XMP operations, then inspect the delivered file, any RAW sidecars and any credentials separately. A sidecar change is not proof that matching information inside a RAW original was removed. For background, see EXIF vs IPTC vs XMP explained and bulk remove GPS metadata from photos on Windows.
Frequently asked questions
Are Content Credentials the same as EXIF data?
No. Ordinary EXIF fields are unsigned camera and file metadata. Content Credentials use signed C2PA manifests, embedded separately or stored externally. A manifest can include copies of EXIF values, so the two can contain overlapping information without being the same structure.
Do screenshots keep Content Credentials?
A screenshot does not automatically inherit the source file’s embedded manifest, though a capture tool can attach its own credentials. Soft bindings such as watermarks or fingerprints may still support a provenance lookup. Neither survival nor detection is guaranteed.
If I strip GPS from EXIF, is my location gone?
Only from the fields actually removed. Check XMP, sidecars and any manifest assertions too. Ordinary metadata cleanup alone is not proof that every copy of location information has been removed.
Can I edit Content Credentials?
Use C2PA-aware software to record supported changes or permitted redactions in a new manifest. Directly changing signed assertions without updating the credential breaks verification rather than producing a valid edited credential.
Does MetaForge remove Content Credentials?
That behavior is not documented in the listing. Inspect a copy with a C2PA-aware viewer before relying on removal or preservation, and do not treat a missing embedded manifest as proof that external provenance is gone.
Try MetaForge
Get MetaForge from the Microsoft Store. It is a one-time purchase with no subscription, and the Store listing shows the current price.
Clean, tag and organize photo metadata in bulk, entirely on your PC.
Get it fromMicrosoft
Microsoft and Windows are trademarks of the Microsoft group of companies. Content Credentials and C2PA are trademarks or names of their respective owners. MetaForge is not affiliated with or endorsed by Microsoft, the C2PA or the Content Authenticity Initiative. This article is general information, not legal advice.