Adobe Firefly's Content Credentials: what they say, and why a checker may call them a legacy match
Adobe says it applies Content Credentials to assets generated entirely with Firefly, naming Adobe Inc. as the issuer. Our checker shows "Content Credentials found; legacy trust-list match" for the three Firefly files we hold. That means the frozen Interim Trust List vouches for the signing certificate and the current C2PA Trust List does not. It is a statement about lists.
What do Adobe Firefly's Content Credentials say?
Adobe's help page on Content Credentials in Firefly (last updated August 25, 2026) says Adobe automatically applies them to assets where every pixel is generated with Firefly, such as Text to Image. The page lists what the record always holds.
| Item | What Adobe says it is |
|---|---|
| Issuer | Adobe Inc., the organization responsible for issuing the credential. |
| Date | The date the credential was issued. |
| App or device | The Adobe application or device used to generate the asset. |
| AI tool used | The Adobe generative AI tool used. |
| Actions | The general editing and processing actions. Adobe says only "Created" or "Other edits" are listed for Firefly features. |
| Output thumbnail | Shown only for assets made with Text to Image on the Firefly website. |
Adobe adds that credentials are attached to the file and may also be stored in Adobe's public Content Credentials cloud. It says the cloud copy makes them durable and recoverable with its Inspect tool.
In our three Firefly files, the signed record declares an IPTC source type: trainedAlgorithmicMedia in two and compositeWithTrainedAlgorithmicMedia in the third. That is what the record says, read by our checker.
What are the two trust lists?
A signature shows that a certificate signed the record. A trust list tells a checker which signers to vouch for. The Content Authenticity Initiative's trust list page says conforming validators must refer to the C2PA Trust List. It describes the older Interim Trust List as superseded and frozen as of January 1, 2026, with no new certificates added. It says validators may consult both lists during the transition but must tell apart credentials signed under each.
| List and file | Date of our copy | Certificates |
|---|---|---|
| C2PA Trust List, signer anchors | October 17, 2026 | 32 |
| Interim Trust List, anchors | January 8, 2026 | 27 |
| Interim Trust List, allowed certificates | April 21, 2026 | 115 |
Why do the Firefly files we tested read "legacy trust-list match"?
We hold three real Firefly files: one vendor sample and two from Wikimedia Commons filed under "Images generated by Adobe Firefly AI". Third parties uploaded the Commons files, so we cannot know how they were handled before upload. This is what our checker reads in files we hold.
Measured on October 30, 2026 in Chrome, all three carry a record with the signer "Adobe Inc." and verified integrity: the signature is sound and the image matches the record. The two lists then gave different answers.
| List checked | Result for all 3 files |
|---|---|
| Current C2PA Trust List | Valid, with the signing credential untrusted |
| Interim Trust List (frozen January 1, 2026) | Trusted |
The C2PA Specification 2.2 separates "Valid" from "Trusted". A manifest is Valid when it is well formed, unmodified since signing, and its signature and time checks pass. It is Trusted when it is Valid and its signing credential receives the code signingCredential.trusted. Section 15.7 says that code needs a chain of trust from the credential to an entry in one of the applicable trust anchor lists. Without it the code is signingCredential.untrusted.
So our checker has a valid record that one list vouches for and the other does not. It reports that as the legacy match, and it names the Interim Trust List in the detail.
We read the subjects of the certificates in our copy of the current list's anchors on October 30, 2026, and one names Adobe Inc. These three files still read untrusted against that list. We report the measured result and give no reason for it. We hold only these three files, so we cannot say how any other Firefly file reads.
Does a legacy match mean something is wrong with the file?
No. The record is intact for all three. We also changed 12 image-data bytes of a signed Firefly file we hold, and the checker read "Content Credentials failed validation". A legacy match is not that result. It says the signature holds and the signer is covered by the frozen list only.
The CAI page adds that content signed while an Interim Trust List certificate was valid is always considered valid under the legacy trust model. The checker's wording is ours.
Records can also be lost. We re-drew each of the 9 real files that carry a record, including the three Firefly files, through a browser canvas, as a PNG and as a JPEG. None of the 18 outputs kept a record, and each read "No supported provenance signals found", which does not mean the image is real or human-made. Adobe says a cloud copy can be recovered with its Inspect tool; our checker never looks anything up online. This was a canvas, not a platform; our screenshot guide has the counts, and the file results above are on our accuracy page.
What this means when you check an image
Open the checker, choose the file, and look for the headline "Content Credentials found; legacy trust-list match". It tells you three things: a signed record is present, its integrity was verified, and the Interim Trust List (frozen January 1, 2026) vouches for the signer while the current C2PA Trust List does not. The findings carry the tier "Verified on the Interim Trust List".
It does not tell you whether the claims in the record are true, who handled the file afterwards, or how the image was made beyond what the signed record says. The C2PA explainer says Content Credentials do not provide value judgments about whether provenance data is true. Our checker also cannot determine whether an image is AI-generated.
The result links to Adobe Inspect, which lists many file types and shows Content Credentials in detail. It opens another company's site, you may need to sign in, and your image is uploaded to them, not to us.
Guides on this topic
- How to tell if an image is AI is the main page on this topic.
- The C2PA Trust List and the Interim Trust List explains both lists in full.
- How to check Content Credentials walks through each result.
- Durable Content Credentials covers recovery after a record is lost.
- Microsoft Image Creator Content Credentials covers the other files that read as a legacy match.
Frequently asked questions
- Is "legacy trust-list match" a warning about Adobe?
- No. It reports which list vouches for the signer. The signature and the match to the image were verified, and the wording describes lists, not the company.
- Could the same file read differently after a list update?
- Yes. The Interim Trust List is frozen, but the current list changes. If it covered the signer and we loaded the new copy, the headline could change. The date of our copy is in the table above.
- Does Adobe put Content Credentials on every Firefly image?
- Adobe's page says it applies them automatically where every pixel is generated with Firefly. It does not say what happens in other cases, so we do not either.
- Does our checker look up the cloud copy?
- No. We never fetch a record from the web. Adobe's Inspect tool is the link to try for that.