In short.
C2PA, the standard behind Content Credentials, and Aqua both attach signed, checkable evidence to digital things. They start from different questions, so they make different choices. Each is described here from its own published documents.
- Built for different jobs. C2PA records where a piece of media came from and how it was edited, and the record travels inside or next to the file. Aqua records evidence about any process or record, such as an approval, an agent’s action or a signed agreement, as a chain of signed entries that is not tied to a file format.
- How signers are identified. C2PA identifies signers through certificates, digital ID cards issued by a certificate authority: an organisation that checks who you are and then vouches for you. Aqua identifies a signer by an identifier taken from the signer’s own key or account, so anyone can start signing without first applying to an authority.
- Who you have to trust. In C2PA, a signature is trusted by default when its certificate leads back to an authority on the C2PA Trust List; checking tools can add other lists. In Aqua, whoever checks the record decides which keys to trust, from their own list or from trust statements signed by parties they choose.
- Who governs. C2PA’s specification is free to read and implement; its member organisations decide how it develops, and its conformance program decides who is on the C2PA Trust List. Aqua is open and permissionless to use: anyone can create, sign and check records without registering, and record types are named by a fingerprint of their own content, so no registry hands out names.
- Where they meet. Both tie signatures to a fingerprint of the content, both can use independent time-stamp services, and both let a holder hide parts of a record while the rest stays checkable. C2PA tells a viewer where a picture came from; Aqua can record the process around it, such as who commissioned, approved or published it.
- What works together today. They work side by side. An Aqua record can refer to a C2PA-signed file by its fingerprint, and the file’s Content Credentials stay intact for C2PA tools to check. Aqua does not read or write C2PA records itself.
What the full comparison will cover.
- Who you have to trust in each, and for what.
- How each one identifies the people and systems that sign.
- Where they overlap with Aqua, where they complement it, and where they differ.
- What works together today.
A reference, not a ranking: each tool is described from its own published specification. What we report, and what we don’t.
Want it sooner?
Tell us what you need to know, and we start there.