C2PA Watermark: Why Content Credentials Need a Soft Binding
A C2PA manifest is bound to a file in two ways. The hard binding, a cryptographic hash of the file's bytes, tells you whether anything changed after signing. A soft binding, an invisible watermark or a content fingerprint, lets you find the manifest again after it has been stripped from the file. You need both because the first proves integrity and the second is designed to survive many of the screenshots and re-encodes that strip metadata.
The C2PA explainer puts the problem plainly: "Can the provenance metadata be removed? Yes it can."
What is the difference between a hard binding and a soft binding in C2PA?
A hard binding is computed from the raw bits of a file. Change one byte and the hash no longer matches, so a validator can tell that the file was altered after it was signed.
A soft binding is computed from the content itself, "rather than its raw bits." The specification describes it as "a fingerprint computed from the digital content or an invisible watermark embedded within the digital content," and says it lets content "be matched even if the underlying bits differ."
The two are not interchangeable. In the specification's words: "Because they serve a different purpose, a soft binding shall not be used as a hard binding."
Hard binding | Soft binding (watermark) | Soft binding (fingerprint) | |
|---|---|---|---|
Computed from | File bytes (cryptographic hash) | A signal embedded in the content | The content's perceptual features |
Main job | Show the file has not changed since signing | Carry an identifier for looking up a stripped manifest | Match content to a stored manifest, and check a recovered match |
After a screenshot or re-encode | No longer matches; embedded manifest usually lost | Designed to remain readable, depending on the algorithm and the edit | Can be recomputed; matching is inexact |
Needs a manifest copy stored elsewhere | No | Yes | Yes |
Why does a C2PA manifest get lost in the first place?
The manifest usually travels inside the file's metadata, and many everyday workflows drop it. The C2PA Soft Binding API document notes that "a number of workflows remove C2PA Manifests, leading to decoupled provenance information from assets." The Content Authenticity Initiative (CAI) says it "remains common for metadata carrying the credentials to be stripped away as images circulate online."
Editing tools matter too. The C2PA explainer says that if an image "is cropped using a non-Content Credentials aware tool, the provenance data may not be updated." A screenshot is the simplest case: the pixels survive, the embedded manifest does not.
How does a watermark help recover a stripped C2PA manifest?
A watermark cannot hold the manifest itself. As the CAI explains, "a watermark can only contain an extremely limited amount of data," so it carries "a short identifier and an indicator of where the C2PA manifest, or the signed metadata, can be retrieved."
Recovery then follows four steps, as described by the CAI and the C2PA Soft Binding API:
Decode the watermark and read the identifier.
Use the identifier to look up the manifest in a manifest repository.
Compare a fingerprint stored in the recovered manifest with one computed from the file, to confirm it is the same content.
Verify the signature and integrity of the recovered manifest.
Step 3 exists because watermarks can be attacked. The C2PA Soft Binding API describes the check as a way to mitigate "the possibility of attacking the watermarking system to spoof (e.g., transfer) a watermark from one asset to another."
Which watermarks can be used as C2PA soft bindings?
Only those on C2PA's soft-binding algorithm list. The specification says "All soft bindings shall be generated using one of the algorithms listed in the soft binding algorithm list," which C2PA maintains as a public JSON file on GitHub.
When we read the list on November 11, 2026, it held 57 entries: 48 watermarks and 9 fingerprints. Each entry names the algorithm, its type and the media types it decodes.
Contents Defence is one of the listed watermark providers. Its entry, added on August 10, 2026, describes an "invisible image watermark, used to recover the associated C2PA manifest when embedded metadata is absent." Image Defence pairs that watermark with C2PA manifest issuing and verification. Separately, Contents Defence is on the C2PA Conforming Products List for image, audio and video. That list covers creating and validating manifests, not the watermark.
A listing tells you the algorithm is registered for use in C2PA manifests. It is not a robustness score. Neither the list nor the conformance program measures how well a watermark survives cropping, compression or AI edits.
What should you check before relying on a watermark for C2PA?
Use these questions when you evaluate a durable Content Credentials setup. They come from the recovery steps above, not from any vendor's test results.
Question | Why it matters |
|---|---|
Is the algorithm on the C2PA soft-binding list? | The specification only allows listed algorithms |
Where is the manifest copy stored, and who runs that repository? | Without a stored copy, the identifier points nowhere |
Is a fingerprint stored for match checking? | It guards against a watermark copied onto other content |
Which edits were tested, on which file types? | Survival depends on the algorithm and the edit; ask for results on your own distribution path |
Can the people who check your files read this watermark? | A validator that does not support the algorithm will only see missing metadata |
What a soft binding cannot tell you
A soft binding helps you find a record that once existed. It cannot create provenance for a file that was never signed, and it cannot recover a manifest whose stored copy is gone. Like any C2PA record, a recovered manifest tells you who signed what and when; the C2PA explainer notes that provenance "alone cannot tell you whether the digital content is true, accurate or factual."
FAQ
Is a C2PA watermark the same as an AI watermark like SynthID?
Not necessarily. A C2PA soft-binding watermark is there to point back to a signed manifest. A watermark acts as a C2PA soft binding only if its algorithm is on the C2PA list and a manifest references it.
Can I use a watermark instead of signing the file?
No. The specification says a soft binding "shall not be used as a hard binding." The signed manifest is still the record; the watermark is the way back to it.
Does a missing manifest mean an image is fake?
No. Adding provenance is optional, and the C2PA explainer says "no assumption should be made about the trustworthiness of a particular asset purely based on its usage of Content Credentials."
Planning C2PA with an invisible image watermark? Ask us about Image Defence: go.contentsdefence.com/review