What exactly gets removed when I remove content credentials?

The C2PA manifest — a signed data block stored in the file's metadata container (JUMBF boxes in JPEG, XMP in PNG and other formats). It records which tool created or edited the image, when, and whether AI was involved. Removing it does not touch the pixels: the image looks identical, it just no longer carries the provenance record.

Is removing C2PA metadata from my own images legal?

Removing metadata from images you own or created is generally lawful. Removing provenance data from someone else's copyrighted work, or in contexts where disclosure is legally required (for example under the EU AI Act for certain AI content distributed in Europe), is a different matter. Inspect first, understand what the file says, and make an informed decision.

Do online C2PA remover tools upload my image?

Most web-based removers process your file on their servers, which means your image — and everything in its metadata — leaves your device. PrivyClean's browser tool runs entirely locally in your browser, and the iPhone and Mac apps are 100% offline by design.

How can I verify the content credentials are really gone?

Re-inspect the cleaned file. PrivyClean shows the metadata before and after cleaning, so you can confirm the C2PA manifest and AI tags are no longer present. You can also cross-check with Adobe's Content Credentials inspector — a cleaned file returns no credentials.

Does removing C2PA also remove watermarks like SynthID?

No. C2PA lives in metadata; pixel-level watermarks such as Google's SynthID are embedded in the image data itself and survive metadata cleaning. Removing content credentials addresses metadata-driven detection and labeling, which is the mechanism platforms like Meta, TikTok, and LinkedIn use today.

Which AI tools embed content credentials?

ChatGPT / DALL-E, Adobe Firefly and Photoshop AI features, Google Gemini, Microsoft Designer, and a growing list of others embed C2PA by default. Midjourney and Stable Diffusion pipelines write their own XMP and IPTC AI tags. PrivyClean detects markers from 20+ AI tools.

Remove C2PA Content Credentials from Images — Free & Offline

Remove C2PA content credentials from your images

Content credentials are a signed C2PA manifest that AI and editing tools embed into image files — recording what tool made the image, when, and whether AI was involved. Platforms read this metadata to auto-label your uploads. Below is a free C2PA remover that runs entirely in your browser (nothing is uploaded), plus what the credentials contain, how to verify removal, and when you should keep them.

Last updated: July 2026 · By Wiktor Tendera

Free C2PA remover — runs in your browser, nothing uploaded

Drop a JPEG or PNG below. The tool strips the C2PA manifest, XMP/IPTC AI tags, and other metadata locally on your device — your image never touches a server. That is the difference from most "free online C2PA removers," which process your file in the cloud. One clean is free; for unlimited images, batches, and HEIC/PDF/Office files, use the iPhone or Mac app.

📄

Drop an image here or click to browse

JPEG, PNG, WebP — up to 25 MB. Processed entirely in your browser.

🔒 Your files never leave your browser. All processing happens locally — no server uploads, no tracking.

What a C2PA manifest actually is

C2PA (Coalition for Content Provenance and Authenticity) is the industry standard behind "content credentials" — backed by Adobe, Microsoft, Google, OpenAI, and Meta. Tools that support it write a cryptographically signed manifest into the file's metadata container: JUMBF boxes in JPEG, XMP packets in PNG. The manifest typically records:

the application that created or edited the image (e.g. ChatGPT, Firefly, Photoshop),
a digital source type — trainedAlgorithmicMedia marks AI generation,
timestamps and an edit history ("actions"),
a signature identifying the issuing tool.

Because it lives in metadata, not pixels, removing it leaves the image visually identical. For the full background, see What is C2PA? Content credentials explained.

PrivyClean inspecting an image and showing the C2PA content credentials and AI source type it carries

Why people remove content credentials

False positives — one AI Denoise or Generative Fill pass on a real photograph writes a full AI manifest, and platforms then label your real photo as AI. Removing the credentials corrects the record.
Auto-labeling on platforms — Meta (Instagram, Facebook), TikTok, LinkedIn, and Pinterest read C2PA at upload and label automatically. See our Instagram and Facebook guides for the platform side.
Workflow privacy — the manifest can reveal which tools you used and when. For client work or commercial assets, that is information you may not want to publish with every export.

Real result

Proof: the same image with and without its credentials

We posted the same AI-generated image twice — once as exported, once after removing its content credentials. Only the version still carrying C2PA was labeled by the platform.

Instagram post of an AI-generated photo showing the 'AI Info' label under the username — Instagram added the **“AI Info”** label automatically.

The same AI-generated photo posted to Instagram after cleaning with PrivyClean — no AI label — Metadata removed first — **no label**.

Result from our own test. Instagram’s labeling can change over time and may use other signals in the future, but removing C2PA and AI metadata addresses the most common trigger today.

Batches, HEIC, PDFs, Word and Excel too

The PrivyClean apps inspect and remove content credentials and all other metadata — entirely offline, one-time purchase.

3 free cleans to try · iPhone $7.99 · Mac $14.99 one-time

How to remove content credentials (and verify it worked)

Inspect the file. Open the image in PrivyClean (or the free tool above). You will see the AI & Provenance group with the exact credentials present — which tool, which source type.
Export a cleaned copy. The C2PA manifest, XMP and IPTC AI tags are stripped. Your original stays untouched.
Verify. Re-inspect the cleaned copy — the AI & Provenance group is empty. You can also cross-check with any C2PA inspector: no manifest found.

When to keep content credentials

Provenance data exists for good reasons. Keep it when disclosure is the point: genuinely AI-generated content for an audience that values transparency, editorial and news workflows, or EU distribution where the EU AI Act expects machine-readable AI disclosure from August 2026. PrivyClean is inspect-first by design — you see what the file says before you decide to remove anything.

Related guides

Important: removing provenance metadata may conflict with platform terms, disclosure obligations, or applicable law depending on the content and where it is distributed. Inspect your files and make an informed decision.