ContentSign is a certificate authority and signing service for the C2PA Content Credentials standard. Order trusted certificates, sign images, video, and documents, and let anyone verify the provenance of your content.
C2PA (Coalition for Content Provenance and Authenticity) is an open technical standard that embeds verifiable provenance information directly into digital files. When you sign content with ContentSign, a tamper-evident credential is embedded in the file itself — no external database, no API lookup required. The proof travels with the content.
Get up and running in minutes. Order a certificate, sign your content, and anyone can verify it.
Sign into the ContentSign portal and request a signing certificate for your organization, team, or application.
Use the ContentSign signing service or download your certificate and sign locally with c2patool. Either way, the credentials are trusted.
Share your signed files anywhere. The C2PA Content Credentials are embedded in the file and travel with it across platforms.
Recipients verify provenance here, via the ContentSign API, or any C2PA-compatible tool. Your chain of trust is always intact.
ContentSign handles the hard parts — certificate management, signing infrastructure, and public verification — so you can focus on your content.
Order X.509 signing certificates issued by ContentSign Authority. Every certificate you receive is chained to our root CA and trusted across the entire ContentSign ecosystem.
Upload content to the ContentSign portal or call the signing API. We embed C2PA Content Credentials with your certificate, sign the manifest, and return your authenticated file.
Anyone can verify content signed by ContentSign. Our free verification tool and public API validate the C2PA manifest and the full certificate chain back to our root CA.
Sign and verify JPEG, PNG, WebP, AVIF, TIFF, MP4, MOV, and PDF. One certificate, one standard, every media format your organization produces.
We operate the certificate authority, manage certificate lifecycle, handle revocation, and maintain the verification infrastructure. You just sign and publish.
Every signed asset carries a verifiable record of its origin: the signing entity, timestamp, and custom assertions. Complete provenance for audit, compliance, and trust.
* Any file type can be signed with an accompanying sidecar signature file, rather than embedded credentials.
Don't want to use our signing service? No problem. Download your issued certificate and sign content locally with c2patool. Your signed files are still trusted and verifiable across the entire ContentSign ecosystem.
Programmatically verify Content Credentials against the ContentSign Authority. Free, public, no authentication required.
Submit a file as multipart/form-data. The response indicates whether the file contains C2PA Content Credentials and whether the signing certificate chains to the ContentSign root CA.
Response Fields
statusverified (ContentSign CA), untrusted (external CA), or unsigned (no C2PA)is_trusted_caBoolean. True if the signing certificate chains to the ContentSign root.chainArray of certificate objects in the chain with subject, issuer, expiry, and fingerprint.manifestClaim generator, title, format, and instance ID from the C2PA manifest.assertionsArray of C2PA assertions embedded in the manifest (actions, attribution, custom data).Example Response
C2PA is the content provenance standard referenced by major regulatory frameworks worldwide.
AI-generated content must carry provenance metadata. C2PA manifests signed by ContentSign provide the verifiable declaration the regulation requires.
The DSA requires disclosure mechanisms for synthetic content. Embedded Content Credentials provide the tamper-evident disclosure trail.
Federal guidance on AI content labeling references C2PA as the provenance standard for content authentication systems.