Credentio: Google Open-Sources Its C2PA Validator

Google just open-sourced the C++ library it’s been using internally to validate C2PA content credentials across 40 of its own products. The library, called Credentio, runs entirely on-device — no cloud upload, no round-trip latency, no privacy exposure. It landed on August 13. With EU AI Act Article 50 and California SB 942 both operative as of August 2, the timing is deliberate.

What Credentio Actually Does

Credentio validates C2PA content credentials locally. Hand it a media file, give it a trust anchor list, and it tells you whether the C2PA manifest embedded in that file is cryptographically valid against your configured authorities. No upload. No API call. No waiting on network latency.

The library handles images, video, audio, and documents. Its design targets resource-constrained environments — embedded client apps, high-throughput server pipelines, and edge deployments where memory overhead matters. Google says it maintains a small footprint even when validating multi-gigabyte video files, where cloud-based validators typically choke, reject the file, or charge by the megabyte.

What makes Credentio more credible than the average open-source C2PA tool: this is not a research project. This is Google’s internal code, now externalised. The same library has been running validation across nearly 40 conformant C2PA-enabled Google products and has processed tens of billions of assets. That production history is the actual differentiator.

Why the Regulatory Calendar Makes This Urgent

If you’re building AI-generated image, video, or audio features and your audience includes EU users or Californians — and whose doesn’t — content provenance is no longer optional.

EU AI Act Article 50 requires machine-readable marking of AI-generated media. The EU’s Code of Practice on Transparency explicitly names C2PA content credentials as a compliant technical solution. Fines run up to €15 million or 3% of global annual turnover. California SB 942, now operative, extends similar requirements to platforms with more than one million monthly users.

Both laws have one thing in common: they assume you can validate your own output. Credentio is how you do that at scale without building cloud infrastructure to handle your own media files.

Generation and Validation Are Different Problems

Credentio is a validator. It does not currently generate or embed C2PA credentials — that distinction matters when you’re planning your pipeline.

The standard approach: generate and embed credentials at creation time using c2pa-rs (Rust, from the ContentAuth Initiative) or c2pa-js for browser-side workflows, then validate credentials downstream with Credentio in your ingestion pipeline, moderation flow, or compliance audit step. Google has credential generation on Credentio’s roadmap. Until then, the two-library approach is the right one.

Getting Started With Credentio

The repository is at mediaprovenance.googlesource.com/credentio. Credentio includes a standalone CLI for quick validation, built with Bazel:

bazel run tools:c2pa_validate -- \
  --asset=/path/to/asset.jpg \
  --claim_signer_trust=/path/to/claim_signer_trust_anchors.pem \
  --tsa_trust=/path/to/tsa_trust_anchors.pem

Two things to know before you start. First, Credentio does not bundle a trust anchor list — you supply your own PEM files, using the C2PA’s official trust list or your own configured authorities. Second, the library currently supports C2PA specification versions 2.2 and 2.4, which covers the vast majority of credentials in production today.

The Verdict

C2PA adoption is accelerating: over 3,500 organisations in the Content Authenticity Initiative, cameras from Leica, Sony, Nikon, and Canon shipping with signing at capture, and major social platforms reading credentials on upload. The validation side — checking credentials at speed and at scale — has been the weak link. Credentio, backed by Google’s production infrastructure and ten billion-asset track record, closes that gap. If you’re shipping AI-generated media and still routing validation through a cloud endpoint, you’re carrying latency and privacy risk on every file. Now you don’t have to.