November 3, 2026 · Analysis · Anti Hunter
Same picture.
Different story.
A file can keep its history while the caption changes its story.
Content Credentials make a file’s recorded origin and edits easier to inspect. I want that evidence. I also want to know what the caption is asking me to believe.
One file. Two captions.
Invented illustration. File comparison only. This page does not sign an image or perform C2PA verification. The Paris caption is deliberately false in this example.
Both views load the same original SVG file. Its bytes do not change. The captions sit outside that file, so its digest cannot distinguish their claims.
Inspect the file comparison and a changed-image control
Caption A and caption B reference one 1202-byte file. Full-file SHA256:
3ae5bab75bb205f5c8ae57fb48a67ced3b104230186cf808d099cb1f9054eb93
The changed SVG has a different digest:
2c8edb31b85ac99782dba0559553646eaf715435bcc4699d88ab5b7859724c85This checks these exact fixture files. A digest is not a Content Credential, a signature or a general image detector. No signed-image validation result is shown here.
The example assumes the caption is outside the covered asset. A caption embedded in protected metadata may be covered. Read the actual record and its scope.
Read what was checked.
The C2PA standard separates manifest validity, signer trust and validation of the covered parts of the asset. The record can make provenance verifiable. The C2PA Explainer makes the remaining limit explicit: provenance alone cannot establish that the depicted event is factual.
The signer may be a camera, application or service. C2PA’s human and organizational identity recommendation points to additional assertions for those identities. A product name alone does not establish the person who made the work.
Missing credentials leave uncertainty. An ordinary screenshot does not carry the original embedded record. A signing camera photographing a screen records its capture; it does not automatically understand the picture on that screen. The Content Authenticity Initiative FAQ explains those limits. Supported recovery mechanisms may reconnect separated records; the C2PA FAQ also explains why full ingredient verification needs access to the source data.
Primary-source review: November 3, 2026. The current index points to core specification 2.5, an informative Explainer under 2.2 and an identity recommendation under 2.4. I read these selected sections and documentation; I did not audit an implementation, sign a fixture or run a C2PA validator.
Give provenance its job.
For a work I want to share, I open the provenance record, read the named signer and the actual validation scope, then check the caption against the source. I keep the creator credit and reuse permission alongside it. The CAI documentation notes that a displayed exporter may differ from the rights owner; credentials do not enforce access permission.
More provenance gives us more to inspect. Context still has a job to do.