Compare Content Credentials before and after removing their container

Start with a file you are allowed to transform

Use unsigned.png for the public exercise. It is an explicitly unsigned synthetic PNG, not a valid signed credential; the transformation demonstrates a storage change. The source-defined reference read is manifest_read with one claim and a Created action. Its original file is 534 bytes.

A separate interoperability check used local copies of the fixed official C.jpg and CA.jpg originals. Removing the C2PA category changed their supported reading from manifest_read to absent while retaining compressed image bytes. No independent signature validator was run before or after, so this does not establish a transition from a valid to an invalid signature. The official originals remain external references, not downloadable site samples.

• Download the explicitly unsigned credential-reading example — Self-authored 534-byte, 1 × 1 PNG with one readable synthetic claim and c2pa.created action. No signature box, certificate trust or valid signed credential is claimed.
• Official C.jpg at c2pa-rs revision 60f7cbdc69ab — Upstream reference, not mirrored here. SHA-256 a2d14755db55de67a47c04090340d8266e892367be4104a45626d7a6fa6e9ffd; one APP11 packet, a 45,872-byte store, c2pa.created and a signature box. Reading is not verification.
• Official multi-packet CA.jpg at the same fixed revision — Upstream original, not mirrored. SHA-256 e71bff58fc57640803e6e65f7534e2fb0c2f99018c85276cc14b30f04427cc76; two APP11 packets reassemble a 117,241-byte store; c2pa.opened and c2pa.color_adjustments were read.

Save a before report and use an explicit cleanup policy

1. Step 1

   Record the untouched original

   Choose unsigned.png in the C2PA checker. In Export this reading · not verified, inspect the complete JSON preview and use Download reading JSON. Keep its hash, manifest_read status and not_verified statement. Leave optional declarations excluded unless the handoff requires them.

   Read the original credential storage

2. Step 2

   Select only the supported C2PA category

   Open Remove metadata with the same file. Clear other category selections, select C2PA containers and retain the color-profile policy you intend. Create and download the verified copy. For PNG this removes the whole caBX container, including the unsigned synthetic claim; it does not edit or re-sign a manifest.

   Create an explicit metadata-removal copy

3. Step 3

   Read the download rather than the old browser result

   Choose the downloaded output as a new C2PA input. The defined copy is 69 bytes and reports absent in the supported locations. Download its new reading report; compare the new SHA-256 and byte length with the original. Keep both original and copy instead of overwriting your only source.

Check the defined before and after

Original SHA-256
9f93391cb723bded7289314abedca7c7ae1b25c6456fbf2c1fa8441461593c4f

Defined removal-copy SHA-256
e878950f8091ec010cf5cc723bdea027a8539cf7147cfea199c2f666232dcd4e

• Download the defined C2PA-removed copy — 69-byte output from removing the whole caBX category from unsigned.png. The supported store is absent and original compressed image bytes were verified unchanged.

Know when no usable removal result exists

The writer refuses animation or multi-picture inputs in unsupported paths, damaged structures, excessive files and outputs that fail re-reading or retained-byte verification. Keep these failures visible; they are not cleaned copies. Selecting a supported category that is absent reports no change rather than inventing removed credentials.

A missing embedded store cannot establish the file's origin, the authenticity of the pixels, or the absence of separate provenance information elsewhere. Removing supported metadata can affect existing credentials, but this tool does not restore trust, re-sign the copy or certify that all private data is gone.

• C2PA Technical Specification 2.2, May 2025 — Fixed primary reference for manifest storage, assertions, actions and validation concepts. This reader implements bounded storage/claim reading, not the cryptographic validation procedures.
• Handle saved prompts with a separate policy — Prompt/workflow text and a credential container are different removal targets.

Sources and reproducible inputs

• Download the explicitly unsigned credential-reading example — Self-authored 534-byte, 1 × 1 PNG with one readable synthetic claim and c2pa.created action. No signature box, certificate trust or valid signed credential is claimed.
• Download the defined C2PA-removed copy — 69-byte output from removing the whole caBX category from unsigned.png. The supported store is absent and original compressed image bytes were verified unchanged.
• Official C.jpg at c2pa-rs revision 60f7cbdc69ab — Upstream reference, not mirrored here. SHA-256 a2d14755db55de67a47c04090340d8266e892367be4104a45626d7a6fa6e9ffd; one APP11 packet, a 45,872-byte store, c2pa.created and a signature box. Reading is not verification.
• Official multi-packet CA.jpg at the same fixed revision — Upstream original, not mirrored. SHA-256 e71bff58fc57640803e6e65f7534e2fb0c2f99018c85276cc14b30f04427cc76; two APP11 packets reassemble a 117,241-byte store; c2pa.opened and c2pa.color_adjustments were read.
• C2PA Technical Specification 2.2, May 2025 — Fixed primary reference for manifest storage, assertions, actions and validation concepts. This reader implements bounded storage/claim reading, not the cryptographic validation procedures.