Is Credentio free to use in a commercial product?

Credentio is published under the Apache-2.0 license, so a company can use, change and ship it inside a commercial product without paying Google. Google says it also wants outside contributions, and invites developers, security experts and media ecosystem partners to work on the code.

Does Credentio need an internet connection to check a file?

Credentio runs completely inside the host application, so a media file never has to be sent to a cloud server or an external validation endpoint to be checked. Google built the API this way for privacy and speed, and kept the memory footprint small so it can handle multi-gigabyte video and high-resolution images.

Can Credentio create Content Credentials, or only check them?

Credentio only validates existing Content Credentials today. Google says it plans to expand the library beyond validation, adding the ability to generate Content Credentials and embed them directly into media files as the C2PA specification evolves.

Which C2PA specification versions does Credentio support?

Credentio supports C2PA specification versions 2.2 and 2.4. It reads both the official C2PA trust lists and custom trust lists supplied through its API, which lets a team validate against its own set of trusted signers instead of only the public one.

Google · 2026-08-13 · major

Credentio — Google open-sources the C++ library behind its content credentials

Credentio is Google's open-source C++ library for checking C2PA Content Credentials inside an app, with no upload to a server. Released under Apache-2.0, it already runs in nearly 40 Google products.

Credentio hero graphic from the Google Developers Blog announcement

Google's C++ library checks C2PA Content Credentials on the device, with nothing sent to a server.

Quick facts

Maker	Google
License	Apache-2.0
Language	C++
C2PA versions	2.2 and 2.4
What it does	Validates Content Credentials locally
Already in production	Nearly 40 C2PA-conformant Google products
Source	mediaprovenance.googlesource.com/credentio

What is it?

Credentio opens up the C++ code Google uses to check C2PA Content Credentials — the signed records that say where an image, video, audio file or document came from and whether AI made it. Google published it under Apache-2.0 on August 13, 2026. The same code already runs inside nearly 40 C2PA-conformant Google products.

How does it work?

The library parses the manifests, assertions, signatures and claims stored inside a media file and reports whether each one verifies and where the integrity breaks. Validation happens entirely inside the calling application, against either the official C2PA trust list or a custom one. A command-line utility ships alongside the library for inspecting a single file by hand.

Why does it matter?

Apps that want to label AI-generated media have had to write C2PA parsing themselves or send user files to a cloud checker. Credentio removes both costs, and it is battle-tested: Google says this code has handled tens of billions of generated images, videos, audio files and documents. That matters more now that visible watermarks are becoming optional and the invisible provenance layer is what is left to check.

Who is it for?

media app, browser and platform developers

Frequently asked questions

Is Credentio free to use in a commercial product?: Credentio is published under the Apache-2.0 license, so a company can use, change and ship it inside a commercial product without paying Google. Google says it also wants outside contributions, and invites developers, security experts and media ecosystem partners to work on the code.
Does Credentio need an internet connection to check a file?: Credentio runs completely inside the host application, so a media file never has to be sent to a cloud server or an external validation endpoint to be checked. Google built the API this way for privacy and speed, and kept the memory footprint small so it can handle multi-gigabyte video and high-resolution images.
Can Credentio create Content Credentials, or only check them?: Credentio only validates existing Content Credentials today. Google says it plans to expand the library beyond validation, adding the ability to generate Content Credentials and embed them directly into media files as the C2PA specification evolves.
Which C2PA specification versions does Credentio support?: Credentio supports C2PA specification versions 2.2 and 2.4. It reads both the official C2PA trust lists and custom trust lists supplied through its API, which lets a team validate against its own set of trusted signers instead of only the public one.

Try it

https://mediaprovenance.googlesource.com/credentio/