← Safety

Content Credentials（内容凭证）Content Credentials

Adobe · Content Authenticity Initiative / C2PA

云端Cloud 本地Local 开源Open source APIAPI partial lifecycle: unknown 核验Checked 2026-11-06

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

未确认的信息Information not confirmed

网页验证器上传文件的留存与使用政策（本次未取到官方声明）
合规认证与数据处理者清单（未取到官方在册页面）
当前生效的 C2PA 规范版本号（两页在册口径不一致）
官方可核验的最近更新节奏（lifecycle 因此记 unknown）
Adobe 自家产品文档面：helpx.adobe.com 当日直抓返回 403，仅取到 Experience League 页
中国大陆接入与备案适用性

Retention and use policy for files uploaded to the web verifier (no official statement found)
Compliance certifications and the data-processor list (no official page fetched with content)
The currently effective C2PA specification version (the two pages disagree)
The cadence of the most recent verifiable official update (hence lifecycle: unknown)
Adobe's own product documentation: helpx.adobe.com returned 403 on the verification day; only the Experience League page was obtained
Mainland-China access and filing applicability

它是一份可验证的「这份内容从哪来、被改过什么」的声明。

站点自己的说法是：用加密 manifest 让受众在 AI 生成内容里证明真实性。关键词是 manifest 与验证，不是拦截。

它是一份可验证的「这份内容从哪来、被改过什么」的声明。

站点自己的说法是：用加密 manifest 让受众在 AI 生成内容里证明真实性。关键词是 manifest 与验证，不是拦截。

适合与不适合When to use it, when not to

适合要出证的发布方、要区分凭证缺失与凭证损坏的审核与取证流程，以及把凭证写进自家资产管的团队。不适合三类期待：拿它当内容过滤器、拿它当「真假判定器」、以及在没有任何签发方写入时指望它凭空验真。本站也不把它与内容过滤线的产品排在一起——两条线回答的问题不同。

中文生态China availability 国产 / 国内可直接用 / 备案状态 · 快照domestic / direct access / CAC filing · snapshot 2026-11-06

出品属地Origin: 国外出品foreign-made　Adobe 发起的 Content Authenticity Initiative，规范现由 C2PA 承载（两站当日在册表述）。Initiated by Adobe through the Content Authenticity Initiative; the standard is now carried by C2PA (wording on record on both sites the same day).
国内使用Direct access: 大陆可直连direct OK　同日实测 contentcredentials.org、verify.contentauthenticity.org、opensource.contentauthenticity.org与 c2pa.org 均返回 200。这只是网页可达性，不等于任何境内合规结论。Same-day probes returned 200 for contentcredentials.org, verify.contentauthenticity.org, opensource.contentauthenticity.org and c2pa.org. That is page reachability only, not a mainland compliance conclusion.
备案状态CAC filing: 备案未核验filing unknown：官方站点与文档均未提中国大陆备案/登记；凭证体系本身也不面向公众提供 AI 服务，备案适用性未核验，不做推断。Neither the sites nor the docs mention mainland filing/registration; the credential system is not a public-facing AI service, and its filing applicability was not verified — no inference is made.

备案信息以网信办《生成式人工智能服务已备案信息》公示名单为准（按批次滚动更新，本站只抄编号不解读）；「大陆可直连」是本站从大陆网络直连实测的结果，不是厂商承诺。GitHub 类站点当日实测有波动，口径写在依据里。Filing status is quoted from the CAC public registry (updated batch by batch; this site copies the number and does not interpret it). "Direct access" is this site's own reachability measurement from a mainland network, not a vendor promise. GitHub-hosted sites fluctuated on the measurement day — the note says so.

固定坐标系Fixed coordinate system

8 个维度dimensions, 与同分区其他对象逐项可比each comparable item by item against others in the same section.

模型与开放条件Model & openness: 它不接模型也不守模型：manifest 由产出内容的工具写入，声明用了哪个应用、设备或 AI 服务。 Adobe 的 AEM 文档页在册：资产详情会列出产生该资产的应用、设备与 AI 工具（例如 Adobe Firefly）以及后续改动。具体哪些模型被披露取决于各签发方写入什么，本站不推断。
It neither connects nor guards models: the manifest is written by whichever tool produced the content, declaring the application, device or AI service used. Adobe's AEM documentation page records that the asset panel lists the applications, devices and AI tools used to produce an asset (Adobe Firefly is the example given) together with later changes. Which models end up disclosed depends on what each issuer writes; this site does not infer it.
运行位置Where it runs: 浏览器里的验证器是主入口：contentcredentials.org 的 verify 当日跳转到 verify.contentauthenticity.org （直抓在册，但该页正文为脚本壳，未见静态说明文字）。本地侧有 SDK 与 C2PA CLI（CAI 文档 hub 在册）；接入方产品（如 AEM Assets）在自家界面内直接显示 manifest。
The browser verifier is the main entry point: contentcredentials.org redirects to verify.contentauthenticity.org, direct-fetched 200 on 2026-11-06, though that page serves a script shell with no static prose. Locally there are SDKs and the C2PA Tool listed on the CAI open-source docs hub; integrated products such as AEM Assets render the manifest inside their own UI.
本地文件Local files: 网页验证器要你上传或拖入文件，本地库与 CLI 在你自己的机器上读写文件并解析 manifest （文档 hub 的 Reader / validate 流程在册）。上传到验证器侧的文件如何留存，本次未取到官方声明，记为未知。
The web verifier asks you to upload or drop a file; the local libraries and CLI read and write files on your own machine and parse the manifest (the Reader / validate flow is on the docs hub). How uploaded files are retained on the verifier side is not stated in anything fetched and is recorded as unknown.
关机后的任务Tasks after shutdown: 没有后台任务面：验证是按需动作，库与 CLI 是单次调用。官方页面未声明队列、续跑或订阅式的批量核验任务，批处理要靠你自己脚本化 CLI。
There is no background-task surface: verification is on demand, and the libraries and CLI are single-shot calls. No queue, resume or subscription-style batch verification is declared officially; batching means scripting the CLI yourself.
工具与扩展Tools & extensions: 扩展面是规范与实现族：CAI 文档 hub 在册 c2pa-rs / Python / C++ / JS / Node / Mobile 库、C2PA CLI、 conformance 与 durable credentials 条目。站点叙事在册 500+ 采用方。MCP 或其他插件协议未见官方声明，记为未知。
The extension surface is a specification plus its implementation family: the docs hub lists c2pa-rs / Python / C++ / JS / Node / Mobile libraries, the C2PA Tool, and conformance and durable-credentials entries. The site carries the 500+ adopters narrative. No MCP or other plug-in protocol statement was found; recorded as unknown.
上下文与记忆Context & memory: 没有会话上下文：一次校验读一份文件的凭证链。AEM 文档页在册：凭证随资产被下载、发布或共享而保留，面板显示签发者名称与签发日期时间。跨资产的索引或「记忆」不在产品口径里。
There is no conversational context: one verification reads one file's credential chain. The AEM page records that credentials stay intact when an asset is downloaded, published or shared, and that the panel shows the issuer name plus issuance date and time. Cross-asset indexing or memory is outside the product.
权限与限制Permissions & limits: 校验的信任根是密码学的：文档 hub 在册用公钥验签名、校验被引用的 assertions，并依赖 PKI / X.509 链与 C2PA trust list；身份 assertion 与签名校验分开绑定角色。合规认证、数据处理方与留存政策本次未取到官方在册声明，记为未知。
The trust root is cryptographic: the docs hub records signature verification with the public key, checking of referenced assertions, reliance on PKI / X.509 chains and C2PA trust lists, and identity assertions bound separately from signature validation. Compliance certifications, the data-processor list and retention terms were not found on official pages and are recorded as unknown. Trademarks and terms belong to Adobe / the CAI and to C2PA.
适合什么任务Best for: 适合发布方与平台把来源与编辑史做成可验证声明，也适合需要区分「没有凭证」与「凭证被改坏」两种状态的审计流程。不适合要拦有害内容的场景（那是内容过滤那条线），也不适合没有任何签发方参与、却想凭空验真的期待。
Fits: publishers and platforms turning provenance and edit history into verifiable claims, and audit workflows that must separate 'no credentials present' from 'credentials tampered with'. Not a fit: anyone wanting harmful-content blocking (that is the content-filtering line) or expecting verification with no issuer involved at all. This site does not rank it against filtering products - the two lines answer different questions.

头号误解Top misconception

以为有 Content Credentials 就等于内容可信：它给的是来源与编辑史，不是真假判定
以为没凭证就是造假或 AI 生成：官方 Inspect 口径要区分「缺失」与「无效」两种状态
把它当审核开关：它不拦内容，只产出可验证声明与校验结论

证据来源Evidence sources

最近核验记录Latest recorded check 2026-11-06，内容更新日content updated on 2026-11-06。单项复核范围见正文或来源说明，不代表所有字段在同一天重新核验。See the text or source notes for item-specific scope; this does not mean every field was rechecked on that date.

类型Type	名称Name	链接Link
docs	Content Credentials · 官网（标准归属、pin 与编辑史叙事、采用方叙事，2026-11-06 直抓 200）Content Credentials · official site (standard ownership, the pin and edit-history narrative, adopter narrative, direct-fetched 200 on 2026-11-06)	https://contentcredentials.org/
docs	Content Credentials · Verify（当日由 contentcredentials.org 跳转至此；正文为脚本壳，2026-11-06 直抓 200）Content Credentials · Verify (reached via contentcredentials.org redirect that day; page is a script shell, direct-fetched 200 on 2026-11-06)	https://verify.contentauthenticity.org/
docs	CAI 开源文档 hub · Getting started（实现族、C2PA CLI、Inspect 区分缺失与无效、PKI/trust list 校验，2026-11-06 直抓 200）CAI open-source docs hub · Getting started (implementation family, C2PA Tool, missing-versus-invalid Inspect wording, PKI / trust-list validation, direct-fetched 200 on 2026-11-06)	https://opensource.contentauthenticity.org/docs/getting-started
docs	Content Authenticity Initiative · 官网（以 C2PA 规范与开源工具为主轴、加入入口与文档路径，2026-11-06 直抓 200）Content Authenticity Initiative · official site (C2PA specifications and open-source tooling as the main axis, membership entry and docs path, direct-fetched 200 on 2026-11-06)	https://www.contentauthenticity.org/
changelog	Content Authenticity Initiative · Blog（官方更新流水线；在册条目含设备与 CDN 侧实现，2026-11-06 直抓 200）Content Authenticity Initiative · Blog (the official update stream; camera, phone and CDN implementation items on record, direct-fetched 200 on 2026-11-06)	https://www.contentauthenticity.org/blog
docs	Adobe Experience League · Content Credentials（AEM Assets 中的 manifest 显示与随下载/发布保留，2026-11-06 直抓 200）Adobe Experience League · Content Credentials (manifest display in AEM Assets and persistence on download / publish, direct-fetched 200 on 2026-11-06)	https://experienceleague.adobe.com/en/docs/experience-manager-assets-essentials/help/content-credentials
docs	C2PA · 官网（开放标准定位、指导委员会成员含 Adobe 与 Truepic、自述当前规范版本，2026-11-06 直抓 200）C2PA · official site (open-standard positioning, steering committee including Adobe and Truepic, self-reported current spec version, direct-fetched 200 on 2026-11-06)	https://c2pa.org/
spec	C2PA · Specifications（规范发布落点，当日跳转至 2.5 目录，2026-11-06 直抓 200）C2PA · Specifications (specification release landing, redirected to the 2.5 directory that day, direct-fetched 200 on 2026-11-06)	https://spec.c2pa.org/specifications/

官方口径与未核到项Official record and unverified items

本站尚未完成实测。本档不含凭证覆盖率、验签成功率或检测率数字。

实测建议（三条）：

同一张图在「无凭证 / 凭证完好 / 凭证被改」三态下验证器的结论差异
不同签发方证书在 trust list 里的可信判定差异
本地 CLI 与网页验证器对同一文件的结论是否一致

This site has not completed measured runs; nothing here covers credential coverage, signature-success rates or detection rates.

Suggested measurements (three):

Verifier conclusions across three states of the same image: no credentials, intact credentials, damaged credentials
How trust-list status differs between issuers' certificates
Whether the local CLI and the web verifier agree on the same file

能力边界Capability boundaries

校验能做的是：验签名、比对内容绑定、检查被引用的 assertions、按 trust list 判断签发者可信度，并明确区分「缺失」与「无效」。它不能保证内容不误导（本站观点）—— 编辑史真实，叙事仍可能骗人；官方页面只把校验范围写成签名、绑定与 assertions。另有一条常被忽略：身份 assertion 与签名校验是分开绑定的，所以「谁签的」和「谁声称自己是谁」在结论里是两件事（文档 hub 在册）。

What verification can do: check the signature, compare content bindings, inspect referenced assertions, judge issuer trust against a trust list, and explicitly separate 'missing' from 'invalid'. What it cannot do, in this site's view: guarantee that content is not misleading - an honest edit history can still accompany a deceptive narrative; the official pages scope verification to signatures, bindings and assertions. One often-missed detail: identity assertions are bound separately from signature validation, so 'who signed it' and 'who they claim to be' are two different findings (docs hub on record).

变更记录说明Change record

本对象没有独立的产品 changelog。可核验的更新流水有三处：CAI 官方博客（在册条目含相机、手机与 CDN 侧的实现落地）、C2PA 规范发布页（当日跳转落点为 2.5 目录）、以及 c2pa.org 自述的当前版本 2.3（发布日 2026-01-08）。两个版本号在同一天的直抓结果里不一致，本档不据此推断实际最新版本，lifecycle 记 unknown。

This object has no product changelog of its own. Three official update streams are verifiable: the CAI blog (device, phone and CDN implementation items on record), the C2PA specification release page (the redirect landed on the 2.5 directory on the verification day), and c2pa.org's self-reported current version 2.3 released 2026-01-08. The two version numbers disagree in the same day's fetches, so this archive does not infer the actual latest version and records lifecycle as unknown.