Google Open-Sourced the Code That Checks Where an Image Came From
Credentio is a C++ library for verifying C2PA Content Credentials on your own device, with nothing sent to a server. The same code already runs inside nearly 40 Google products.
Google has released Credentio, an Apache-licensed C++ library that verifies C2PA Content Credentials. In plain terms: it reads the invisible receipt attached to an image, video or document and tells you whether that receipt is genuine. The company says the same code already runs inside nearly 40 of its own products, so this is battle-tested rather than a research demo.
Content Credentials are a standard from the C2PA, an industry group that includes Adobe, Microsoft, the BBC and Google. The idea is a tamper-evident record baked into the file itself: which camera or which model made it, when, and what was done to it afterwards. Each step is cryptographically signed, so if someone edits the file without re-signing, the check fails. Credentio parses those manifests, assertions, signatures and claims and reports on each one. It supports C2PA versions 2.2 and 2.4 and can validate against the public trust list or a list you define yourself.
The part that deserves attention is where the checking happens. Credentio runs entirely on the device. Nothing gets uploaded. Until now, a developer who wanted to verify a file either had to write C2PA parsing from scratch, which is a lot of fiddly cryptography, or ship the user’s file off to a cloud service, which is an odd thing to do when the whole point is trust.
Why does Google give this away? Because provenance only works if everyone uses it. A receipt nobody can read is worthless, and the standard needs to be everywhere before it is useful anywhere. There is also a shift behind the timing: visible watermarks, the little corner logos on AI-generated images, are increasingly optional in Gemini and elsewhere, and they were always easy to crop off anyway. Cryptographic provenance is what is left. Be clear about its limits, though. Content Credentials prove that a file carries a valid signature from a known source. They do not prove a photograph is truthful, and a file with no credentials at all is not evidence of anything. Plenty of honest cameras, screenshots and old photos simply have nothing attached.
What this means for you: nothing to install today, and no button appears in your photo app this week. But over the next year you should expect more “where did this come from” indicators in browsers, messaging apps and news sites, and this release removes one of the reasons developers skipped building them. If you make or publish media professionally, it is a good moment to check whether your camera, phone or editing software can attach Content Credentials, because being able to prove your own work is real is about to be worth more than being able to spot someone else’s fake. And if you build apps that display user-uploaded media, this library is now a free, local way to add that check.
Sources
1,221 Volunteers Pointed AI Agents at 2,200 Research Papers. Nearly a Quarter Did Not Hold Up
Hugging Face published every attempt from a 19-day challenge to re-run ICML 2026 experiments with coding agents. 496 papers had at least one claim contested or falsified.
