Essay

Claude watermarks explained

A practical guide to statistical text watermarks, C2PA file credentials, and the limits of “watermark removers.”

By Ansh · 9 September 2026 · Originally on Medium

An editorial illustration of flowing text revealing a statistical pattern under a magnifying lens. — Conceptual illustration created with AI. The pattern is a visual metaphor, not a scan of a real Claude watermark.

Copy a Claude response into a plain-text editor. Change the font. Remove the formatting. The paragraph looks ordinary.

Have you removed its watermark?

The answer depends on what was there in the first place. A formatting trace, a signed file credential, and a statistical pattern in generated language are different things. A tool can successfully remove one while telling you nothing about another.

I build Claude Watermark Remover, so I have a direct interest in this topic. That also makes the distinction worth stating clearly: a useful cleanup result is not automatically a verified watermark-removal result.

Here is what the current documentation and underlying research actually support. Research checked 9 September 2026.

What Anthropic has confirmed

Anthropic says Claude uses a version of Google DeepMind’s SynthID-Text. It changes how randomness is used during text generation, allowing a later check for a statistical pattern. The company explicitly says the method adds no hidden characters. Its technical explanation was published on 14 August 2026 and updated on 1 September.

The current Claude Help Center guidance names Fable 5.1 and Mythos 5.1 as supported models. It says models launched on or after 2 August 2026 support marking at launch, with support for older models still being added. For supported models, the scope includes Claude’s apps, API, coding tools, and cloud partners, worldwide; support for particular file-marking features can vary.

Those details matter when reading an older article. A claim about “all Claude text” can erase the distinction between model generations. A statement that detection is simply “coming soon” misses the newer private-preview rollout.

How can ordinary words carry a watermark?

A language model generates tokens: units that can correspond to words, parts of words, or other text. At each step, it has a distribution of possible next tokens.

Google’s explanation of SynthID describes watermarking at that generation stage. The signal emerges across the choices the model makes, rather than from a visible label attached afterward.

Consider this deliberately simplified example:

The team described the launch as…

Depending on the context, several continuations might be reasonable: “promising,” “encouraging,” or “successful.” They are not perfectly interchangeable, and this is not a real model probability table. The point is that language often gives a model room to choose.

Anthropic describes using a secret key together with preceding text to influence the randomness behind such choices. It does not mean Claude always prefers one particular adjective. The relevant pattern depends on context and accumulates across a passage. Anthropic’s technical explanation

For an intuition, imagine two people choosing routes through a city. Both take plausible streets. One makes choices spontaneously; the other follows a private, repeatable rule whenever several routes are equally suitable. Looking at a single turn tells you little. Looking at many turns, while knowing the rule, may reveal a pattern.

That analogy explains the role of accumulated evidence. It is not an implementation of SynthID, and real language generation has much more complicated probabilities than a street map.

The original SynthID-Text paper, published in Nature in October 2024, describes a watermarking method that changes sampling without retraining the language model. It reports benchmarks, human comparisons, and a live evaluation involving nearly 20 million Gemini responses. Those are results about the researched system; they are not an independent benchmark of every Claude model.

Two separate workflows: statistical marking during text generation and signed C2PA metadata attached to supported files. — Conceptual overview. Text detection evaluates a statistical signal; file verification checks signed provenance metadata. Neither establishes the complete authorship history.

Three things that often get called a “Claude watermark”

When evaluating a checker, first identify which of these it actually examines.

1. The statistical text watermark

This is the generation-time signal described above. Finding it requires an appropriate detector. A list of unusual Unicode characters is not a measurement of that signal.

2. Copy-paste and formatting traces

Text can contain non-breaking spaces, zero-width characters, or HTML attributes. You can inspect these directly. For example, this site checks for supported hidden characters and HTML class names containing “claude.”

That is useful for cleaning pasted content, but these observations need careful interpretation. An invisible character can serve a legitimate purpose. Punctuation, including em dashes and curly quotes, is not proof of AI authorship.

Try this small example:

Before: hello[U+00A0]world
After:  hello world

Here, the bracketed label represents a non-breaking space. Normalizing it changes a character in the text. It does not test the process that selected the words “hello” and “world.”

3. C2PA Content Credentials

These are signed provenance records associated with files. They answer a different question from a statistical text detector.

The practical test is simple: ask a tool to name the evidence it found. “Three unusual spaces” is a specific observation. “Definitely written by Claude” is a much larger conclusion.

What a detector can—and cannot—tell you

Anthropic’s Fable 5.1 and Mythos 5.1 announcement describes a text detection API in private preview. Access includes eligible organizations such as researchers, media, educational organizations, regulators, and certain enterprises. That is different from an unrestricted public text checker.

Google’s SynthID developer documentation explains that detection is probabilistic. Its provided detector can return watermarked, not watermarked, or uncertain, with thresholds affecting false-positive and false-negative rates. These are useful concepts for understanding detection; they should not be mistaken for a published specification of Anthropic’s API response.

The same documentation explains that watermark configurations must be kept private. Open-source watermarking code therefore does not, by itself, give an unrelated website the ability to authenticate Claude’s watermark.

There is also a distinction between a watermark detector and a general AI-writing classifier. A classifier estimates whether text resembles material in its learned categories. A watermark detector looks for evidence of a deliberately introduced signal. Their scores are not interchangeable.

Imagine a writer creates the argument, research, and first draft, then asks an AI to rewrite several paragraphs. A signal from those paragraphs cannot independently establish who developed the ideas. Conversely, a negative result does not reconstruct the document’s history.

For editors and educators, the useful move is to treat a detector result as one piece of evidence. Ask about drafts, sources, edits, and the relevant rules before turning a probability into an accusation.

C2PA: the file has its own provenance trail

Anthropic’s public Claude Content Checker checks files for Claude-issued Content Credentials. The company says the checker runs locally in the browser. It explicitly does not check the statistical watermark in text.

A Claude-issued credential can indicate that Claude made or processed a file. The checker’s documentation gives PNG, JPEG, and SVG as examples of generated file types that can carry credentials. A supported input format in a checker should not be read as a promise that every Claude workflow generates that format with credentials.

The C2PA explainer describes a framework for recording provenance and checking its integrity. It also makes an essential distinction: provenance information does not establish whether the depicted content is factually true.

Think of a credential as evidence about a document’s recorded processing history. A valid record that an image passed through a particular tool does not validate every claim a caption makes about that image.

Metadata can also be lost or removed. Its absence is therefore not proof that a file was created without AI. This is why a file-cleaning result should describe the metadata changed, rather than claim to settle the file’s entire origin. This site’s in-browser C2PA strip is that narrower job.

What happens when you edit or rewrite the text?

Different operations change different parts of a document.

Changing the font changes presentation. Cleaning an HTML class changes markup. Normalizing a space changes a character. Rewriting a paragraph changes the language itself.

Google reports that SynthID text signals can survive some cropping, small edits, and mild paraphrasing, while substantial rewriting or translation can reduce detection confidence. That is a finding about the technique’s limits, not a success guarantee for a particular remover. Google DeepMind

Short, tightly constrained answers also give watermarking less room to operate. Google’s developer guidance notes that factual responses provide fewer opportunities to modify generation without reducing accuracy.

This suggests a better way to evaluate a rewrite service: separate text quality from watermark detectability.

For quality, you can compare the passages yourself. Did the rewrite change a date? Omit a qualification? Turn a possibility into a certainty? Preserve a quotation accurately?

For detectability, you need a suitable verifier and a defined testing procedure. A fluent rewrite and a green checkmark are not substitutes for that measurement.

In particular, a change in a general AI classifier’s score does not demonstrate success against Claude’s separate watermark detector. See GPTZero, Turnitin, and ChatGPT.

Does the watermark identify you?

Anthropic says the watermark contains no information identifying the user, organization, or conversation. Its September model announcement repeats that point.

That statement has a specific scope. It does not mean the passage is anonymous. A name, email address, private anecdote, or other identifying detail in the actual writing can still identify someone.

When deciding whether to paste a draft into any service, look at what the service receives and how it handles the text. Watermark design and a service’s privacy practices are separate questions.

Why is Anthropic doing this now?

The regulatory context is the EU AI Act’s transparency requirements. The European Commission says the relevant Article 50 obligations apply from 2 August 2026, subject to scope and transition provisions. Its Code of Practice FAQ distinguishes provider-side marking from obligations concerning the labelling of certain published content.

The Code of Practice is a voluntary route to demonstrating compliance; it is not the law itself, nor a rule requiring every provider to use the same algorithm.

For a reader, the useful consequence is that “AI watermark” will increasingly describe multiple implementations. A method, key, detector, or credential associated with one provider should not automatically be assumed to work for another.

Where this tool fits

Claude Watermark Remover is built around practical tasks people can inspect:

Free text checking and cleaning: identify supported copy-paste traces and remove them in the browser.
Optional paid rewriting: rephrase text using a non-Claude model, with the result available for human review.
A separate file cleaner: remove supported C2PA metadata from PNG, JPEG, and SVG files locally.

The tool is independent of Anthropic. It does not have access to Anthropic’s private text detector, so a cleaned or rewritten result is not certified removal of the statistical watermark.

There is still a useful reason to have these workflows. A developer may want to diagnose unexpected characters in a pasted string. A writer may want to clean formatting or revise awkward phrasing. Someone handling an image may want to understand which credentials its file contains before making an informed choice about its metadata.

Those are concrete jobs. Each deserves a concrete report of what changed.

If you try the tool, keep the original, inspect the output, and review any rewrite for meaning and accuracy. Cleaning joiners or other invisible characters can affect legitimate text, including some emoji and languages. Choose the operation because you understand its effect.

A better question to ask about any watermark remover

Instead of relying on the product name, ask:

What exact signal does this tool inspect?
What does it change?
Does it verify the result against the relevant detector?
Which conclusions remain uncertain?

Those questions are useful whether you use this site, Anthropic’s checker, or another service.

The most valuable distinction is between an observable change and an inferred history. You can see that a character was removed. You can verify a credential’s signature. You can evaluate statistical evidence with the appropriate detector. None of those operations, alone, tells the entire story of who created a piece of work.

Understanding that boundary makes the technology more useful—and the claims around it easier to judge.

Open the free checker Shorter explainer →

Related guides

Independent of Anthropic. Same essay as published on Medium. For the compact site version, see how Claude watermarks work.