Content credentials in Paint by Zaweba: proving no AI was used

Pictures now travel with a question attached: was this made or changed by AI? Content credentials are one answer. They are a signed record inside an image file, following the C2PA standard, that says how the image came about. Paint by Zaweba can add one to every JPEG and PNG you save, and because the app has no AI services at all, the record can say plainly that no AI was used.

The option is in Preferences under Files and Recovery. It is off by default, so nothing is added to your files unless you choose it.

What the record says

When content credentials are on, each JPEG and PNG carries a C2PA record stating which software made it, whether the picture was created there or edited there, and that no AI was used. Tools that read C2PA can show that information to anyone who checks the file, and because it is signed, changing the file afterwards breaks the signature in a way those tools can detect.

That is different from ordinary metadata such as File Info. A copyright line in XMP can be typed by anyone. A signed record is tied to a key, which makes it much harder to fake.

Where the key lives

The signing key is made on your PC and stored encrypted for your Windows account. It isn't fetched from a server and it doesn't depend on an online account, which fits the way Paint by Zaweba works generally: offline, no account, no telemetry. The consequence is that the key belongs to your Windows user on that machine, so it is worth keeping your Windows account secure like anything else you rely on.

Who it helps

Illustrators and painters who want to show their work was done by hand are an obvious group. A painting that arrives with a record saying it was created in Paint by Zaweba with no AI is a stronger statement than a caption.

Photographers who submit to competitions, news outlets or clients with rules about generative tools can show that an edit was retouching rather than generation. Teachers and students can use it to show coursework was made in a known way.

It can also help in quieter ways. Agencies and brands that keep an archive of approved images can tell, years later, which files came from where.

Things to understand

Content credentials describe the history the signing software knows about. A record from Paint by Zaweba speaks for what was done in Paint by Zaweba. If an image came from somewhere else first, the record reflects that it was edited here, not everything that happened before.

Some websites strip metadata on upload, and that can remove the record too. The credentials are most useful where files are passed on intact: email, shared drives, submissions and portfolio downloads.

Re-saving in another program may drop or invalidate the record. Do your final export from Paint by Zaweba if the credentials matter for that file.

Switching it on

Open Preferences, go to Files and Recovery, and turn content credentials on. From then on every JPEG and PNG you save is signed. If you only want them on some work, turn the option on before those exports and off afterwards.

Most people will never need to think about provenance. For those who do, having it built into a free, offline editor that has never used AI is a simple and honest way to stand behind your pictures.