Home › Claude text watermark
What Claude’s text watermark actually is
Since 2 August 2026, Claude models weave a statistical watermark into generated text by nudging token selection with a secret key. It is not zero width characters, it survives copy and paste, and no character level cleaner removes it. The public detector does not exist yet.
What changed on 2 August 2026
Anthropic began marking Claude’s text output. The trigger was the EU AI Act Article 50(2) Code of Practice on Transparency of AI-Generated Content, which requires providers of generative AI to mark output so it can be identified as machine made.
The rollout was worldwide rather than EU only, and it covers the Claude apps, the API, Claude Code, Cowork, Tag, and the cloud partner deployments. Models launched before that date are unmarked for now. Anthropic’s framing is that the mark is imperceptible and does not change the meaning, quality or readability of the response.
It was not a quiet change. Forbes, PhoneArena, Notebookcheck and Interesting Engineering all covered the backlash, and that coverage is why anybody is searching for a remover at all.
Is it zero width characters?
No, and almost every tool selling a Claude watermark remover says otherwise. The mark is statistical. At each generation step, the model’s choice among statistically near equivalent next tokens is biased according to a secret key. The signal is distributed across the pattern of word choices in a passage.
The reason it was built that way is straightforward. A marking made of zero width spaces or Unicode variation selectors would be visible in a hex editor and removable with a single regular expression, which makes it worthless as a provenance system. Anyone describing Claude’s watermark as invisible characters is describing something that would have failed at its only job.
What survives and what does not
| Action | Effect on the watermark |
|---|---|
| Copy and paste | Survives |
| Light editing, a few word swaps | Survives |
| Deleting invisible characters | No effect at all |
| Replacing em dashes and smart quotes | No effect at all |
| Changing file format or re-saving | No effect on text |
| Heavy paraphrase or full rewrite | Degrades, may fall below threshold |
| Very short passages | Never reliably detectable |
| Code formatters and linters | Degrades, especially in code |
Read that table as a description, not a recipe. The two things that actually degrade the signal are rewriting the text yourself and the passage being too short to carry a signal, neither of which is a feature any tool can sell you.
What the detector can and cannot prove
First constraint: it is not available. Detection tooling was described as forthcoming, with no public API, no access model and no published technical documentation. As of today, nobody outside Anthropic can check a passage.
Second constraint: even once it ships, the result is weaker than it sounds.
- A detected mark is not proof of AI authorship. Claude may have edited, summarised or proofread something a person wrote. The mark records that the text passed through the model, not that the model composed it.
- No mark is not proof of human authorship. The model may predate the rollout, the passage may be too short, or it may be a different model entirely.
- Short text is undecidable. Statistical watermarks need volume to accumulate signal.
Anyone planning to use detection as an accusation, in a classroom or a newsroom or an HR process, should read those three limits carefully first.
So what are the invisible characters people keep finding?
Real, and worth removing, and unrelated to the watermark. Zero width space (U+200B), zero width non joiner (U+200C), zero width joiner (U+200D), soft hyphen (U+00AD), word joiner (U+2060) and non breaking space (U+00A0) do appear in text pasted out of AI tools, along with em dashes, smart quotes and ellipsis characters.
They cause genuine damage: false git diffs on bytes that render identically, broken database keys, failed string comparisons, mangled CSV parsing, search indexes that miss the word. Developers were stripping them long before anyone was watermarking anything.
Removing them is text hygiene. It is just not watermark removal, and a tool that conflates the two is selling the wrong story. The full character list and what each one breaks.
What this site does about it
Text mode removes the characters above and reports every one it touched by code point. It does not claim to defeat the statistical watermark, because it cannot, and neither can anything else that edits characters.
If your reason for cleaning text is that invisible characters are breaking your build, your database or your diff, that is exactly what the tool is for. If your reason is to conceal that a model was involved where you are obliged to disclose it, the tool will not achieve that and this site does not support the attempt.
Reporting on this rollout is nine days old and some sources disagree about how widely the watermark is deployed today. The technical claims here follow the most detailed available accounts and Anthropic’s own description. Verify against primary sources before relying on any of it in a decision that matters. Nothing here is legal advice.
Frequently asked questions
When did Claude start watermarking text?
2 August 2026. Claude models launched on or after that date carry the mark. Models released before it are unmarked during a transition period with no announced end date, so output from an older model may carry nothing at all.
Does it apply outside the EU?
Yes. The trigger was the EU AI Act Article 50(2) Code of Practice on Transparency of AI-Generated Content, but the marking was rolled out worldwide rather than gated by region. It covers the Claude apps, the API, Claude Code, Cowork, Tag, and the cloud partner deployments on AWS, Google Cloud and Microsoft Foundry.
Can I see the watermark in a hex editor?
No. There is no character or byte to find. A statistical watermark is a pattern across many token choices, so nothing shows up under inspection of the file. That is the whole design intent: a marking you could see would be a marking you could delete.
How much text does the detector need?
More than a sentence. Statistical watermarks work by accumulating a signal across many token choices, so short passages fall below the reliability threshold and cannot be called either way. Anthropic has not published the specific length threshold, and the detector itself is not public yet.
Does a detected watermark prove the text is AI written?
No. A mark can appear because Claude edited, summarised or proofread text that a person wrote, and its absence does not prove human authorship because the model may predate the rollout, the passage may be too short, or the text may have been heavily rewritten. Treat it as a signal about how a file was processed, not a verdict on who wrote it.
Do the Claude image outputs carry something different?
Yes. Files can carry C2PA signed manifests, which are cryptographic metadata attached to PNG, JPG and SVG. Unlike the text watermark those are trivially removed by converting the format, re-saving, or screenshotting. They are a provenance record, not a lock.