Remove C2PA Metadata (Content Credentials) From Images
C2PA is the provenance standard behind “Content Credentials” — a signed manifest embedded in image files that records what created them, what edited them, and when. ChatGPT images carry it. Adobe tools attach it. Some cameras now sign it at the moment of capture.
This tool removes the C2PA manifest from your files completely and losslessly, without your image ever leaving the browser.
JPG, PNG and WebP · the report shows the manifest before you remove it
What a C2PA manifest contains
C2PA (the Coalition for Content Provenance and Authenticity) defines a manifest: a structured, cryptographically signed record bundled into the file itself. A typical manifest names the tool that produced the image, timestamps, the kinds of edits applied, and assertions like digitalSourceType — the field that formally labels a file as AI-generated. Manifests can chain: an image edited in Photoshop can carry the record of the original generation plus the record of the edit.
Because the manifest is signed, inspectors don't just read claims — they verify who made them. That's the standard's whole point, and it's also why the record is worth understanding before you share a file carrying one.
Where C2PA hides in each format
The manifest is packaged in a JUMBF container (an ISO box format) and embedded differently per file type: in JPEGs it occupies one or more APP11 segments; in PNGs it lives in a dedicated caBX chunk; in WebP files it sits in a C2PA chunk inside the RIFF container. Most metadata tools predate the standard and miss these locations entirely — a file can pass a casual EXIF check while carrying a full signed provenance chain.
This remover targets all three locations explicitly, alongside the classic metadata blocks (EXIF, XMP, IPTC, text chunks), and the report names each removed section so you can see the caBX or APP11 block leave.
Who embeds Content Credentials today
AI generators are the biggest source: OpenAI attaches C2PA manifests to ChatGPT and DALL·E images, and Adobe Firefly output carries Content Credentials by default. Adobe's creative suite can attach credentials on export from Photoshop and Lightroom. Hardware is joining: Leica and Sony have shipped cameras that sign photos at capture. LinkedIn and other platforms have started displaying provenance badges read from this data.
In other words: if you work with AI images or a modern Adobe pipeline, assume some of your files are carrying signed provenance until you've checked one.
Legitimate reasons to remove it — and honest limits
The manifest is a workflow diary. It can reveal which tools you use, when you produced an asset, and how it was assembled — details a freelancer may not want to hand a client, a client may not want passed downstream, and a pseudonymous publisher may not want attached to their identity. Removing the manifest from files you own and distribute is your call to make, the same way stripping EXIF from a photo is.
Two honest limits. First, removal is not anonymity: pixel-level watermarks such as SynthID survive metadata removal, and some ecosystems can re-associate a cleaned file with its cloud-registered credentials by fingerprint matching. Second, if your goal is to misrepresent AI output as human-made evidence or art, a stripped manifest won't accomplish that — and that use is on you, not the tool.
How the removal works
The file is parsed structurally in your browser: the manifest's container sections — APP11 segments, caBX or C2PA chunks — are deleted whole, along with the rest of the metadata layer, and every remaining byte is copied through untouched. No decode, no re-encode, no quality change; container size fields and feature flags are corrected so the output is a perfectly standard file.
Verify it yourself: clean a file, drop the result back in, and the report reads empty. Any external C2PA inspector will likewise report no credentials found.
Frequently asked questions
Is it legal to remove C2PA metadata from my images?
Removing metadata from files you own and have the right to distribute is generally your prerogative — same as stripping EXIF. What you represent the file to be afterwards is a separate question and your responsibility; platform terms and local rules about provenance disclosure may apply when publishing at scale.
Can the Content Credentials be recovered after removal?
Not from the file itself — the manifest sections are deleted whole and the file is reassembled without them. However, ecosystems like Adobe's can match a file back to credentials registered in their cloud using invisible-watermark fingerprinting, if the creator enrolled it. Removal cleans the file; it can't un-register a cloud record.
Does removing C2PA also remove SynthID or other AI watermarks?
No. SynthID and similar systems live in the pixel pattern, not the metadata, and are designed to survive exactly this kind of cleaning. This tool removes the metadata layer only and is honest about that boundary.
Are my photos uploaded to a server?
No — photos are cleaned entirely inside your browser tab using JavaScript. You can verify this yourself: open DevTools, switch to the Network panel, and watch it while you clean a photo — zero file transfers. Only non-image formats (PDF, video, audio) use our cleaning server: encrypted in transit, processed immediately, deleted immediately, never stored.
