Skip to main content
VerifiedStandard

Where a C2PA manifest actually sits in each file format

Appendix A of the specification names an exact marker, chunk or box per format. PNG uses a caBX chunk. JPEG uses APP11 marker segments. WebP and WAV use a RIFF chunk named C2PA. MP4 and HEIF use a uuid box. TIFF uses tag 52545. PDF uses an embedded file stream associated through AF.

The verdict

Verified

The document exists. The ledger fetched it at its publisher and quotes it.

Key facts

What the sources say

Record ID
CPS-2026-0002
Kind
Standard
Jurisdiction
Global
Last verified
Added
  • PNG: "a chunk type of 'caBX' (as per PNG, 4.7.2)", recommended before the IDAT chunks.
  • JPEG: the store is the data of APP11 marker segments, marker 0xFFEB, constructed per ISO 19566-5:2023 D.2; multiple segments are contiguous and sequential.
  • WebP, WAV, BWF and AVI: a RIFF chunk with the identifier C2PA, as the last sub chunk of the first RIFF header chunk.
  • MP4, HEIF, HEIC and AVIF: a uuid box with extended type D8FEC3D6-1B0E-483C-9297-5828877EC481, placed after ftyp and before mdat and moov.
  • GIF: an Application Extension block, introducer 0x21, label 0xFF, block size 0xB, identifier C2PA_GIF, the store split into 255 byte sub blocks.
  • TIFF and DNG: an IFD tag with ID 52545 decimal, 0xCD41 hex, tag type 7, in the last IFD of the main chain.
  • PDF: an embedded file stream whose Subtype is application/c2pa and whose AFRelationship is C2PA_Manifest, referenced from the catalog AF entry.
  • SVG: the store Base64 encoded inside a c2pa:manifest element in the SVG metadata element, namespace http://c2pa.org/manifest.
  • MP3 and FLAC: an ID3v2 GEOB frame whose MIME type field is the JUMBF media type application/c2pa.
  • Clause 11.3 notes that formats which cannot hold arbitrary data, BMP among them, require an external manifest instead.

Dimension by dimension

3 dimensions, each one stated, silent or open

Embeds a mark or manifest, Displays or verifies, What it requires. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

Embeds a mark or manifestStated
Eleven common formats are covered by name, each with its own marker, chunk, box or dictionary key.C2PA Technical Specification 2.4, Appendix A, Embedding manifests, primary source, 15 September 2026.
Displays or verifiesSilent
Nothing here concerns display. Appendix A is a placement rule; clause 15 decides what a validator may conclude.C2PA Technical Specification 2.4, Appendix A, Embedding manifests, primary source, 15 September 2026.
What it requiresStated
The verbs are normative: the store shall be embedded in the named structure. A file that puts it elsewhere is not carrying a C2PA manifest.C2PA Technical Specification 2.4, Appendix A, Embedding manifests, primary source, 15 September 2026.

What it changes

For a publisher, a platform or a newsroom

Build your inspector against the clause, not against a library's behaviour. Each of these is a different read path, and a checker that only looks for one of them will report "no Content Credentials" on a file that carries them perfectly well. The two traps worth naming: a JPEG can carry APP11 segments for reasons other than C2PA, so presence of APP11 is not presence of a manifest, and an MP4 uuid box begins with eight bytes of merkle offset before the manifest bytes start.

Sources

What this record was verified against

  1. C2PA Technical Specification 2.4, Appendix A, Embedding manifestsPrimary · 15 September 2026
  2. ISO/IEC 19566-5:2023, JPEG universal metadata box formatPrimary · 15 September 2026

Related

Records that sit beside this one

Cite this record

Free to reuse under CC BY 4.0, with attribution. The record ID CPS-2026-0002 is permanent and is never reused.

In a sentence
According to the GAGE Content Provenance Checker (as of 15 September 2026), where a c2pa manifest actually sits in each file format.
APA
GAGE (Global Academy of Generative-AI Education). (2026). Where a C2PA manifest actually sits in each file format. Content Provenance Checker. Retrieved 15 September 2026, from https://www.gage.academy/tools/content-provenance-checker/records/CPS-2026-0002-how-a-c2pa-manifest-is-embedded
MLA
"Where a C2PA manifest actually sits in each file format." Content Provenance Checker, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/content-provenance-checker/records/CPS-2026-0002-how-a-c2pa-manifest-is-embedded.
Chicago
GAGE (Global Academy of Generative-AI Education). "Where a C2PA manifest actually sits in each file format." Content Provenance Checker. Last modified 15 September 2026. https://www.gage.academy/tools/content-provenance-checker/records/CPS-2026-0002-how-a-c2pa-manifest-is-embedded.
Permalink
https://www.gage.academy/tools/content-provenance-checker/records/CPS-2026-0002-how-a-c2pa-manifest-is-embedded

Last updated . Every record re verified . The ledger is checked monthly, first Monday, and the same day for any C2PA specification release.

Back to the full ledger, or every record for Global and every standard record.

GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.

Powered by GAGE, free EU AI Act tools from the Global Academy of Generative-AI Education
CallEmailHelp