Your camera can now sign a photo the way you'd sign a contract
For most of photography's history, "is this photo real?" came down to trust. In 2026 that's finally changing at the hardware level. A new class of cameras writes a cryptographically signed record into the image file at the instant of capture — a tamper-evident stamp that says this camera took this frame, and here's what happened to it since.
The standard is called C2PA Content Credentials, and it's no longer a demo. Leica, Nikon, and Sony are all shipping it.
The short version: your photo now carries a verifiable "nutrition label" you can inspect in your browser — no special software required.
What are Content Credentials?
Content Credentials are built on the C2PA standard (Coalition for Content Provenance and Authenticity), backed by Adobe, Microsoft, the BBC, and camera makers. Think of it as a chain of custody for a photo.
When a supported camera takes a picture, it embeds a signed manifest inside the file. That manifest records things like:
- The camera make and model that captured the image
- The date and time of capture
- A cryptographic hash of the pixels, sealed with the manufacturer's key
- Any later edits made in software that also supports C2PA (crop, exposure, AI generative fill)
The signature is the important part. If a single pixel changes after signing without a new credential being added, verification breaks. You can't quietly doctor the image and keep the "verified" status.
This lives alongside the ordinary metadata you already know — the EXIF block with shutter speed, ISO, and sometimes GPS. The difference is that regular EXIF can be edited by anyone with the right tool, while a Content Credential is cryptographically signed.
Which cameras have it (2026)
Leica got there first. The Leica M11-P, announced in late 2023, was the world's first camera to embed Content Credentials in-camera. Leica has since extended the feature across more of its rangefinder and SL-series bodies.
Nikon brought C2PA to the Z6III through a firmware update rolled out in 2025, and pairs it with a cloud-based Nikon verification service aimed at newsrooms and agencies.
Sony added Content Credentials to its Alpha line through firmware — bodies including the Alpha 1, Alpha 1 II, Alpha 9 III, Alpha 7 IV, and Alpha 7S III — with signing keys provisioned through the Sony Creators' App on a paired phone. Sony has been piloting this with news organizations since 2024.
Canon and others have announced plans, and Google's Pixel and Samsung's Galaxy phones have begun tagging AI-edited images with Content Credentials too. The list grows every firmware cycle.
Why this actually matters
Two forces made this urgent.
First, generative AI made convincing fake photos trivially cheap. When anyone can prompt a photorealistic image of an event that never happened, the burden flips: instead of proving a photo is fake, we increasingly need a way to prove one is real.
Second, newsrooms and courts need provenance. A wire photo from a conflict zone, an insurance claim photo, a piece of evidence — all are stronger when you can trace them to a specific device and confirm nothing was altered. Reuters, the AFP, and the BBC have all worked on C2PA workflows for exactly this.
Content Credentials don't tell you a photo is "true" — they tell you where it came from and whether it's been changed since. That's a narrower, more honest claim, and it's exactly what verification needs.
How anyone can verify a photo — free, in a browser
You don't need a press badge or special hardware to check a credential.
- Content Credentials Verify — go to
contentcredentials.org/verify, then drag in an image or paste a URL. It reads the signed manifest and shows you the capture device, edit history, and whether the signature is intact. The file is checked in your browser. - Browser extension — the Content Authenticity Initiative and Digimarc offer extensions that flag credentialed images as you browse.
- Command line — developers can run
c2patool photo.jpgto dump the raw manifest as JSON.
One caveat worth internalizing: a missing credential is not proof of a fake. The vast majority of photos online have no Content Credential at all, because they came from cameras and apps that don't support it yet, or the data was stripped in transit. Absence means "unknown," not "fake."
The metadata connection
If this feels familiar, it should. A Content Credential is, at heart, structured data written into the file — a more advanced, tamper-evident cousin of the EXIF metadata that's been riding inside your JPEGs for decades.
The same skill applies: to understand a photo, you read what's baked into it. You can open any image in an EXIF viewer to see the ordinary metadata — camera, lens, timestamp, and sometimes GPS coordinates — and use a tool that will find where a photo was taken from that embedded location data. Content Credentials add a signed, verifiable layer on top of that same idea.
And the reverse is worth knowing: because this is all metadata, it can be removed. If you value privacy over provenance, you can remove GPS from a photo before sharing it — though stripping a file will also break any Content Credential it carried. That's the trade-off between anonymity and authenticity.
Where this is heading
Expect Content Credentials to spread from flagship cameras down to mainstream bodies and phones, and to show up as a small "cr" badge on photos across social platforms and news sites. It won't end misinformation — determined bad actors will screenshot, re-photograph, or simply strip the data. But it gives honest publishers a way to stand behind their images, and gives readers a button to press instead of a gut feeling to trust.
The next time a dramatic photo goes viral, you'll have a real question to ask: does it have a credential, and does it check out?
Curious what your own photos are carrying right now? Drop one into our EXIF viewer and see exactly what metadata — and what location — is baked into the file.