Remove C2PA Content Credentials: Creator Guide

I first heard about C2PA when Instagram slapped a "Made with AI" label on a photo I'd spent two hours editing. The original was generated in Midjourney, sure, but I'd composited it with stock photography, added text overlays, and color-graded it in Lightroom. Yet Instagram decided it was "AI-generated" based on metadata buried so deep in the file I didn't even know it existed.

That sent me down a rabbit hole. I spent the next week learning everything I could about C2PA Content Credentials — what they are, how they work, and most importantly, how to remove them. Here's everything I learned, explained for creators who just want their images to look clean when they post.

What Is C2PA?

C2PA stands for the Coalition for Content Provenance and Authenticity. It's a joint effort between Adobe, Microsoft, the BBC, Sony, and other major players in media and tech. The goal — which I actually respect — is to create a tamper-evident system for tracking the origin and history of digital media.

Think of it as a digital paper trail baked into the image file itself. Every time an image is created, edited, or modified by a C2PA-compliant tool, a new "manifest" is added to the file. These manifests are cryptographically signed, creating a chain of custody that can be verified independently.

Adobe is the driving force behind C2PA through their Content Authenticity Initiative (CAI). They've integrated C2PA into Photoshop, Lightroom, and Firefly. But they're not alone — OpenAI, Midjourney, Stability AI, and others now embed C2PA manifests in their generated images.

How JUMBF Manifests Work

This is where it gets technical, but bear with me — understanding this made the removal process make a lot more sense to me.

C2PA manifests are stored using a format called JUMBF (JPEG Universal Metadata Box Format, ISO 19566). JUMBF was designed as a generic container for embedding arbitrary metadata in image files. C2PA uses JUMBF boxes to store its Content Credentials.

The key thing to understand is that JUMBF manifests are stored differently depending on the file format:

In JPEG files, JUMBF data lives in APP11 markers. JPEG files use APP markers (APP0 through APP15) to store metadata. APP11 is specifically used for JUMBF. Each APP11 segment can hold up to 64KB of data, so large manifests can be split across multiple APP11 markers.

In PNG files, the situation is different. PNG uses chunks for everything, and C2PA manifests are stored in a caBX chunk. This is a proprietary chunk type that most PNG readers don't understand — they just skip over it. But C2PA-aware tools know to look for it.

The reason this matters for removal is that you can't just "delete the metadata" the way you might with EXIF. JUMBF manifests are structurally embedded in the file format itself. A proper removal tool has to parse the file format, locate the specific JUMBF boxes, and remove them without corrupting the rest of the file.

What's Inside a C2PA Manifest?

When I inspected my first C2PA manifest, I was surprised by how much information it contained. Here's what I typically find in a C2PA manifest from an AI-generated image:

Claim generator: The software that created the manifest (e.g., "OpenAI", "Midjourney")
Action: What happened to the image (e.g., "planned", "composed", "drawn")
Timestamp: When the manifest was created
Assertions: Claims about the image, including whether it was AI-generated, what model was used, the processing history, and sometimes a thumbnail of the original image

That's a lot of information. And it's all cryptographically signed, so you can't just edit the manifest to change what it says — any modification invalidates the signature.

How I Discovered My Images Were Being Labeled

My wake-up call came when I posted a series of images on Instagram. Three out of five had "Made with AI" labels. The other two didn't. All five were generated by AI. The difference? The three that got labeled were exported directly from the generation tool. The two that weren't had passed through a photo editing app that happened to strip C2PA data during its own export process.

That's when I realized: the labeling isn't consistent, it isn't smart, and it's entirely metadata-driven. Instagram doesn't analyze the pixels to determine if an image looks AI-generated. They simply scan for C2PA manifests. If the manifest is there, you get a label. If it's not, you don't.

My Step-by-Step Removal Process

Here's the process I now use for every image before posting:

Step 1: Inspect the Image

I start by uploading the image to our Remove AI Metadata tool, which shows me a breakdown of all metadata present — C2PA, EXIF, XMP, everything. This gives me a baseline.

Step 2: Strip C2PA Content Credentials

Next, I use the dedicated Remove C2PA Content Credentials tool. This specifically targets JUMBF manifests in JPEG APP11 markers and PNG caBX chunks. It parses the file format properly and removes only the C2PA-related boxes, leaving the image data intact.

Upload the image to the tool.
The tool identifies all C2PA manifests in the file.
It removes the JUMBF boxes from JPEG (APP11) or PNG (caBX).
Download the cleaned file.

Step 3: Verify Removal

I always verify. I use the Verify C2PA tool to check the cleaned image. If it reports "No Content Credentials found," the removal was successful. I also cross-check at contentcredentials.org/verify for an independent confirmation.

Step 4: Clean Up Other Metadata

While I'm at it, I also strip EXIF and XMP data using the general Remove AI Metadata tool. C2PA is the primary trigger for AI labels, but XMP can also contain generation parameters and tool names that some platforms might use.

Practical Tips

Don't strip C2PA from images you're selling or licensing. If you need provenance for commercial work, C2PA is valuable. I keep two versions of every image: one with metadata for archival, one stripped for posting.

Re-verify after any edits. If you clean an image and then edit it in Photoshop or another C2PA-compliant tool, that tool may add a new manifest. I learned this the hard way.

The chain of custody doesn't survive removal. When you strip C2PA, you're breaking the cryptographic chain permanently.

Different tools leave different traces. Midjourney's C2PA manifests tend to be more detailed than DALL-E's. The removal process is the same, but it's worth knowing what's in there.

Why I Remove C2PA Despite Supporting It

I actually think C2PA is a good idea in principle. Provenance matters in an era of deepfakes and misinformation. But the current implementation has problems: it's binary (labeled or not), it doesn't account for human creativity applied to AI-generated images, and it's enforced inconsistently across platforms.

Until the labeling systems get smarter, I'll keep stripping C2PA from images where I want to control how they're presented. The Remove C2PA Content Credentials tool makes it quick, and I always verify with Verify C2PA to make sure it worked. For a broader cleanup that includes EXIF and XMP, the Remove AI Metadata tool is my go-to.

It's not about hiding that I use AI. It's about controlling the narrative.