Claude Text Watermark Explained: How It Works (Sept 2026)

The rollout, the news cycle, and the explanation happened on three different dates. Anthropic's marking policy took effect quietly: models launched on or after August 2, 2026, the day EU AI Act Article 50 transparency duties became applicable, support machine-readable marking at launch, per Anthropic's support documentation.

The support article was live by the evening of August 10, and press coverage followed within hours and through August 11: Interesting Engineering, then TechCrunch, Tech Times, Fortune, and others. Those stories, and everything written before August 14, could only describe what the watermark was, not how it worked: the support documentation was all Anthropic had published.

The technical explanation arrived on August 14: a post titled "How Claude's text watermark works" that names the mechanism family, walks through what survives editing, and announces a detection API. That post is the primary source for this page, and it makes much of what currently ranks for these queries outdated.

One more distinction worth keeping straight: the technical explanation is not the detection documentation. Anthropic's support article still promises details on detection mechanisms in forthcoming technical documentation, and as of August 15 it does not even link the August 14 post. What was published explains how marking works, not how checking will.

September 1, 2026 turned the marking policy into a list of models. Anthropic launched Claude Fable 5.1 and Claude Mythos 5.1, the first Claude models to ship on the far side of its own August 2, 2026 threshold, and its help centre then stated "Models currently supported include Fable 5.1 and Mythos 5.1." (By September 25, 2026 that sentence had been replaced by a per-model table.) The Claude Platform release notes for the same day say it in engineering terms: "Text generated by Claude Fable 5.1 and Claude Mythos 5.1 carries Anthropic's text watermark."

The launch post is also the cleanest public source for what the watermark does not contain. On the mark itself it says: "This watermark is invisible to anyone who does not have the detection API. It has no practical impact on the quality or content of Claude's outputs and contains no information about the user, their organization, or their conversations with Claude."

Detection shipped the same day, into a private preview. Anthropic's help centre and its August 14 post, updated September 1, both say detection is available to eligible organizations as required under EU law, and both give the same list: regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, and EU civil society groups. Enterprises with their own EU AI Act verification duty may also apply. Anthropic says it plans to expand access over time and names no date.

Updated September 25, 2026. Anthropic's help centre now carries a per-model table, "Which Claude models support watermarking", with separate columns for text on Anthropic's own surfaces, text on AWS, Google Cloud and Microsoft Foundry, and C2PA in files. It ticks the text watermark for Claude Fable 5.1, Mythos 5.1, Opus 5.5 and Opus 5, and says that on cloud partners Opus 5 marking is "gradually available" from September 14, 2026 and fully available within one week. Opus 5.5 launched on September 22, 2026, after the threshold, so it is marked from launch. The same day Anthropic emailed Claude Platform customers under the subject "Watermarking begins September 30, 2026". The email says "Claude Opus 5 was the first of these, on September 14", five days after the September 9 the administrator notice gave; this page uses September 14, the date the email gives. The help centre table confirms Opus 5 as marked but gives no first-party date; its footnote dates only the cloud rollout from September 14. It says Anthropic "will begin applying its EU AI Act text watermark" to Claude Fable 5, Claude Sonnet 5 and Claude Opus 4.8 on September 30, 2026, and that "Rollout on Amazon Bedrock, Google Cloud, and Microsoft Foundry may take a few additional days." As of September 25, 2026 the help centre table does not tick those three models for text, so their date is an official announcement. The help centre also now sets an end date for the retrofit: "Anthropic is adding watermarks to outputs from models released before August 2, 2026, with all covered by December 2, 2026." Claude Mythos 5 and the 4.x models other than Opus 4.8 have no date of their own.

The horizon shortened twice, and every version is Anthropic's. The August 14 post says of models launched before August 2, 2026: "The EU law includes a transition period for Anthropic models launched before August 2, 2026, and we're working to add watermarking for those models as well. This will be rolled out over the coming months." The September 4 notice said "the coming weeks". The New Stack reported the "coming months" version as current on September 1, 2026. The help centre now gives a date, December 2, 2026, which matches the EU deadline in Article 111(4) of the AI Act. The August 14 post, reopened September 25, 2026, still says months.

Two more claims sit only in that notice, and both answer questions readers ask constantly. Anthropic tells administrators there is no public tool for checking text and that it "does not see or store text submitted to" the detection API. That second commitment is the obvious privacy objection to a detection API, and as of September 25, 2026 it has no public source: neither the help centre nor the news post says anything about whether Anthropic sees or stores submitted text.

The reason the mark turns up everywhere is a design decision Anthropic states publicly. Its help centre: "Watermarking will be applied at the model level, which means it will be present no matter which Claude product or surface the text comes from." The September 4 notice repeats that for administrators as applied at the model layer, and lists chat, Cowork, Claude Code, and the API. The help centre's own list is longer and is the one to use: Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag.

Cloud access carries the text mark and only sometimes the file metadata. The help centre: "When supported Claude models are accessed through AWS, Google Cloud, or Microsoft Foundry they will carry watermarks. Content Credentials (C2PA) are added when Claude creates a file, so it applies only where a platform offers Claude's file generation features", which it lists as the Claude apps and the Claude Platform (API), including Claude Platform on AWS and Claude in Microsoft Foundry. The text mark can reach a partner cloud later than Anthropic's own surfaces: a week for Opus 5, and "a few additional days" for the September 30 wave, per Anthropic. So an AWS or Foundry deployment of a supported model produces watermarked text; whether it produces credentialed files depends on whether that platform offers Claude's file generation at all.

• C2PA scope one, the apps. The help centre says Claude attaches signed provenance metadata when it generates a supported file type such as a PNG or JPEG, and gives no start date. The September 4 notice dates it: files Claude creates in the apps "have carried a C2PA Content Credential since September 1". That date is notice-only as of September 25, 2026.
• C2PA scope two, the API. The platform release notes for September 1, 2026 describe something different: "supported image, video, and audio files that Claude produces through the code execution tool carry C2PA Content Credentials when you retrieve them through the Files API on the Claude API." Different surface, different file types, same standard. Do not merge the two scopes.
• Files have a free public checker; text does not. Anthropic's help centre points to the Claude Content Checker at claude.com/check-files, which needs no sign-in, reads Content Credentials on 17 listed formats (JPG, PNG, GIF, WEBP, TIFF, HEIC, AVIF, SVG, DNG, JXL, MP4, MOV, AVI, WAV, MP3, M4A, FLAC), and states "Your file stays on your device." It also states "The tool does not check text."

Everything in this section that came only from one of the two emails is graded Official announcement rather than Confirmed, which is the site's label for something stated in an official communication but not yet reflected in product documentation. Claude Opus 5 moved to Confirmed on September 25, 2026, when this site found it ticked in the help centre table. Claude Fable 5, Sonnet 5 and Opus 4.8 move to Confirmed when the table ticks their text column.

The article's title is the heading above, it lives at support.claude.com, and it is the canonical statement of Anthropic's marking commitments. It opens by recording that Anthropic signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content as a provider of both generative models and generative systems, and says Anthropic will update the article and publish more detailed technical guidance as it becomes available.

Four commitments carry the content. New models mark from day one, meaning Claude models launched in the EU on or after August 2, 2026 support machine-readable marking at launch, with embedded watermarks in text and signed provenance metadata on files where supported. Marking works everywhere Claude does, across Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag, worldwide. Existing models are in progress under the law's transition period. And watermark detection is in private preview for the eligible organizations listed above.

Two techniques, described separately, are the part most coverage blurs. Embedded watermarks are woven into generated text and do not change its meaning, quality, or readability. Signed provenance metadata follows the C2PA standard and is attached when Claude generates a supported file type such as a .svg, .png, or .jpg. The article's limitations section is the sentence to remember in both directions: a detected mark indicates content may have been processed by Claude and is not conclusive, and lack of a detected mark does not mean the content was not AI-generated or processed.

Read it at the source rather than through us. The full article is linked in the sources at the foot of this page, and it is the document Anthropic itself tells administrators to send to users who ask questions.

Claude generates text one token at a time. At each step there is a set of candidate next words, and many of the choices among them are low-stakes: important, useful, and valuable can all continue the same sentence without changing what it says.

Without watermarking, the model settles those close calls with randomness. With watermarking, Anthropic says the choice is settled by a secret key together with a few of the preceding words. The output is still natural text, and the words still look randomly chosen. But someone holding the key can recompute what the keyed process would have preferred at each step and check whether a passage's choices are consistent with it far more often than chance.

Anthropic's own analogy: play a board game, but replace the dice with successive digits of pi. The game plays out normally, and anyone who has the digits of pi can verify afterward that pi was steering the moves.

One property matters more than it sounds: the watermark changes the source of the randomness, not the shortlist. Anthropic is explicit that it does not push Claude toward words it would not otherwise have considered, giving the example that it would not make Claude reach for an obscure synonym like "nubilous" instead of overcast or grey. The candidates stay the candidates. Only the tiebreak changes.

Anthropic names its lineage directly: the method is a version of the SynthID-Text approach that Google DeepMind published in Nature in 2024, part of a family of keyed sampling watermarks going back to a 2022 proposal by Scott Aaronson.

• Confirmed by Anthropic: the mechanism family, the role of a key plus preceding words, that only the randomness source changes, no hidden characters, no extra tokens, no added cost, and internal testing showing no impact on content, creativity, or readability.
• Not published by Anthropic: the exact algorithm, how many preceding words seed the key, which SynthID-Text configuration it runs, how keys are managed, and the detector's math. The family is named; the specification is not.
• Our interpretation, labeled as such: naming SynthID-Text tells you the kind of detection to expect, a statistical score over many tokens rather than a lookup. It does not license copying DeepMind's published parameters or numbers onto Claude, and the Nature paper describes more than one configuration without Anthropic saying which it uses.

That last distinction runs through the rest of this page. Where a sentence below is Anthropic's, it is quoted or attributed. Everything else is context from the published research literature on this family of watermarks.

Anthropic's post is unusually blunt on this point: nothing is added to the text and there are no hidden characters. That single sentence retires most of what circulated before it.

• Zero-width characters: no. Not the mechanism, per Anthropic directly.
• Invisible Unicode spaces or variation selectors: no. Same sentence.
• Metadata attached to copied text: no. File metadata does not travel with ordinary plain-text copy/paste. A statistical watermark avoids that dependency because its signal is carried by the generated text itself.
• Em dashes or punctuation habits: no. Style tells are real observations about model writing, but no provider has publicly named punctuation as a watermark, and Anthropic did not.
• Hidden HTML or formatting tricks: no. The signal survives paste-as-plain-text because it is the words, not the wrapper.

Claude output may still contain some of those things in the ordinary course of writing. They are just not the watermark, and removing them does not touch it.

Paste Claude's output into Google Docs, Word, an email, or a CMS and the thing the detector would score, the sequence of chosen words, arrives unchanged. Anthropic's support documentation says the mark travels with copied text for exactly this reason.

What copy and paste does lose is formatting and any file-level metadata. Neither carries the watermark, so losing them changes nothing. This is the practical difference between a statistical text watermark and every attachment-based scheme: there is nothing bolted on that a destination app could strip.

Copying is not transforming. The signal only starts to move when the words themselves change, which is the next section.

Anthropic's own summary: "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will." It adds, of the full-rewrite case, that it is arguable whether such text can still be described as AI-generated at all.

Between those poles, expect the signal to weaken as more of Claude's word choices are replaced. Anthropic publishes no thresholds, and any page telling you that changing some percentage of words removes the watermark is inventing a number that no publicly available detector can currently verify.

• Length matters. Short passages contain few choices and therefore little signal. Anthropic: as a passage increases in length, confidence about Claude's involvement increases too.
• Constraint matters. Factual passages watermark sparsely because there is often only one correct continuation. Anthropic's example: after "Isaac Newton's most famous work was called Principia", only "Mathematica" is right, so there is no choice to encode.
• Transformation type matters. A translation produced by Claude is watermarked, because every output word is Claude's choice. Heavy third-party rewriting sits at the other end of the spectrum.

Anthropic gives exactly two fixed points, the light-editing and complete-rewrite poles quoted above. Everything below places specific, commonly asked actions against those poles plus the length and constraint factors Anthropic names. None of the middle is publicly measured, by us or anyone else, until the detection API ships.

• Copy/paste into any editor, email, CMS, or website: expected to survive. Evidence: Anthropic direct, the signal is the word sequence and copying preserves it exactly.
• Formatting changes (bold, headers, markdown, plain-text reflow, pasting into Notepad): expected to survive. Evidence: Anthropic direct, the mark lives in word choice, not in formatting or file structure.
• Typo and grammar correction on human-written text: little to nothing to detect in the first place. Evidence: Anthropic direct, addressing the proofreading case specifically.
• Light manual editing of Claude's own output, a handful of words changed: probably not removed. Evidence: Anthropic direct, this is the light-editing pole.
• Moderate rewriting, a meaningful minority of words replaced: may weaken. Evidence: our inference, interpolating between Anthropic's two stated poles. No published threshold exists.
• Heavy rewriting or thorough paraphrasing, most words replaced: substantially weakened, trending toward removed. Evidence: our inference from Anthropic's poles, consistent with independent robustness research on this watermark family, which tested open reimplementations, not Claude itself.
• Complete rewrite, every word replaced: removed, on Anthropic's own account, with the caveat that Anthropic itself calls it arguable whether such text still counts as AI-generated at all.
• Summarizing Claude's output in your own words: functionally a heavy-to-complete rewrite. Evidence: our inference, since a summary by definition replaces most of the original wording.
• Expanding Claude's output with substantial human-written additions: the Claude-written stretches keep whatever signal they had; the added text carries none. Evidence: our inference from the mixed-document case Anthropic describes.
• Translation produced by Claude itself: watermarked. Evidence: Anthropic direct, every output word is Claude's choice.
• Translating Claude's output afterward with a person or a different tool: word choices are replaced, placing it at the rewrite end of the spectrum. Evidence: Anthropic's support article lists translation among the changes that can leave content without a detectable mark; the degree is our inference.
• Functional code where only one output compiles or is correct: little to no watermark applied by design. Evidence: Anthropic direct.
• Code comments and documentation, where wording is free: watermarked like ordinary prose. Evidence: Anthropic direct.
• Removing zero-width characters, invisible Unicode, or other hidden formatting: no effect on this watermark. Evidence: Anthropic direct, there are no hidden characters, so there is nothing in that category to remove.
• Very short passages of any kind, edited or not: weak signal regardless of transformation, simply because there are too few word choices to accumulate a detectable pattern. Evidence: Anthropic direct.

No row above can currently be verified by running a detector, because the only detector is Anthropic's and its private preview is limited today to eligible organizations under EU law rather than to this site. Treat every "our inference" row as reasoning from Anthropic's own stated poles, not a measurement, and be skeptical of any source that states a specific percentage here.

People ask this question tool by tool, and the answer does not change by name: no third party, including this site, has run any of these tools' output against a real Claude watermark detector, because the only one is in a private preview we do not hold access to as of September 25, 2026, and no public detector for text exists at all. What follows is reasoning from Anthropic's published statements, not experimental results, and it is labeled that way in every row.

• Grammarly and Word's built-in editor, used for spelling, grammar, and style suggestions: these change relatively few words, which resembles Anthropic's light-editing case. Not independently tested. Our reasoning: probably does not fully remove the mark, by analogy to light editing, not by measurement.
• Google Docs' built-in suggestions and spelling/grammar check: same category and same caveat as Grammarly and Word.
• QuillBot and other dedicated paraphrasing tools: these replace substantially more wording than a grammar check, closer to the heavy-rewriting end of the spectrum. Not independently tested. Our reasoning: likely weakens the signal more than light editing does, with no published threshold for how much.
• Asking ChatGPT or Gemini to rewrite Claude's output: if the other model regenerates the passage rather than lightly editing it, that approaches Anthropic's complete-rewrite pole, word by word. Not independently tested. Worth separating from the removal question: the output would be that other model's generation, carrying whatever watermark policy that model uses, if any, rather than a cleaned version of Claude's text.
• Dedicated translation tools applied after Claude has already produced text: covered in the transformation reference above as a rewrite-class case. Not independently tested.

Treat any site claiming a tested, verified percentage for how well Grammarly, QuillBot, ChatGPT, or Gemini defeats Claude's watermark as making a claim it cannot currently back up. That evidence does not exist publicly yet, for anyone.

Most of what is wrong about Claude's watermark online is not dishonest, it predates August 14 and never got corrected. These six keep resurfacing anyway.

• "Claude's watermark is a zero-width character." No. Anthropic states directly that nothing is added to the text and there are no hidden characters. A zero-width character is something a scanner can find and delete; this mark is a pattern across many word choices with nothing to point to in any single character.
• "Removing invisible Unicode removes Claude's watermark." No, for the same reason. A hidden-character cleaner, including this site's own, operates on a different layer entirely and cannot touch a signal that was never stored in a character.
• "Removing em dashes removes Claude's watermark." No. Punctuation preference is a real, separately documented stylistic tell in AI writing, but no provider, including Anthropic, has publicly named punctuation as part of a watermarking mechanism. Deleting em dashes changes style, not the token sequence a detector would score.
• "Pasting into Notepad removes it." No. Notepad strips all formatting and any file metadata by design, which is exactly why it is a clean test of the underlying claim: the words that come out are identical to the words that went in, and the watermark lives entirely in which words those are.
• "An AI detector can tell you whether the watermark is gone." No. A generic AI-writing detector like the stylometric tools covered elsewhere on this site scores writing style without a key and without knowledge of Claude's watermark at all. It can return a confident-sounding verdict that has nothing to do with whether Anthropic's specific signal is present.
• "If a watermark is detected, Claude wrote the whole document." No. Anthropic is explicit that detection indicates likely Claude involvement and cannot distinguish text Claude wrote from text Claude heavily edited. A positive result is consistent with a thousand human words and one Claude sentence, not just with fully AI-authored text.

Character cleaning does nothing here. Removing zero-width characters, hidden Unicode, metadata, or unusual punctuation cannot address this watermark, because the signal is not stored in any of those. This site's own cleaner inspects and strips hidden Unicode, which remains useful against character-level marking that does exist in the wild, and for text hygiene. It does not, and cannot, remove Anthropic's statistical text watermark. Any tool that says otherwise is describing a different technology.

Transformation is the only category that plausibly affects a statistical signal, and the verified evidence base is one sentence long: light editing probably insufficient, complete rewrite sufficient. The middle is unmeasured, and it stays that way without detection access, because you cannot verify removal of a signal you cannot check for, and checking requires Anthropic's key.

So the honest answer to "can I remove it" is: partially, probably, at rewrite depths nobody can currently quantify, with success nobody can currently confirm. Distrust confident removal guarantees for as long as no independently runnable detector exists to hold them to.

Anthropic's detection API entered private preview on September 1, 2026, limited today to eligible organizations under EU law, and we found no independently validated public third-party detector. Its help centre states detection is "currently in private preview, available to eligible organizations as required under EU law" and lists the categories: regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, and EU civil society groups, plus enterprises with their own verification duty. Access is requested through a form, Anthropic says it plans to expand over time, and it names no date. Its developer documentation still publishes no detection endpoint, so even an accepted applicant is working from something the rest of us cannot read.

One privacy commitment is worth naming and one caveat comes with it. Anthropic's September 4, 2026 notice to administrators says it "does not see or store text submitted to" the detection API, which is the obvious objection to sending a passage to the company that made the model. As of September 25, 2026 that commitment appears on no public Anthropic page, so it is an official statement rather than documentation a reader can check.

Anthropic says detection relies on its watermark key. Without access to the necessary key or detection mechanism, a third party cannot directly reproduce Anthropic's official check from the public documentation alone. The sites offering a Claude watermark checker today appear to be doing one of two other things: scanning for hidden characters, which Anthropic says are not the mechanism, or running a generic AI-writing classifier, which is a different technology entirely.

Anthropic is also specific about what its detector reports: the likelihood that text was partly written by Claude. It will not recognize other providers' watermarks, because even providers using the same family of schemes hold different keys.

Anthropic's marking policy covers Claude Code by name, alongside the apps and the API. The technical post explains the limit that comes with that: where an exact output is required, where a different token would break the code or state a falsehood, the watermark is not applied.

Anthropic's summary is that code generally carries less watermarking than other kinds of text. Where code does have genuine freedom, Anthropic points to comments: word choice there is arbitrary, so comments are watermarked, with a negligible effect on the code itself.

The New Stack reported the same rule from the other direction on September 1, 2026: if choosing a different token could make an answer incorrect or break the code, Anthropic does not apply the watermark. That is press rather than a primary source, and the article does not attribute the sentence to a named Anthropic document, but it matches what the August 14 post says about constrained output.

The practical reading for developers: a short, tightly constrained snippet may carry little or no signal, while a longer generated file with comments and documentation carries more. Anthropic publishes no per-language or per-length figures, and this page will not invent any.

The proofreading case gets its own answer in Anthropic's post. If you write 1,000 words and Claude fixes the grammar, nearly all the words are yours, and in Anthropic's phrasing there is very little, if anything, for the watermark to attach to. Depending on length and edit depth, Claude's involvement might not be detectable at all.

Translation splits in two. A translation produced by Claude is watermarked, because every word of the output is Claude's choice. Text that started as Claude output and was then translated by a human or another tool has had its word choices replaced, which is the rewrite end of the editing spectrum; Anthropic's support documentation lists translation among the changes that can leave content without a detectable mark, and publishes nothing more specific.

Mixed documents follow from the same logic: the signal lives in the stretches Claude wrote, diluted by everything humans wrote around them, with detectability depending on how much Claude text survives and how long it is.

Claude watermark detection, once it exists, will ask: is the specific keyed signal Anthropic embeds present in this text? A known signal, intentionally placed, statistically scored. Generic AI detectors ask a different question: does this text read like model output? No key, no embedded signal, just stylistic inference. Anthropic's own post draws this line, pointing to detection software like Pangram as the key-less alternative that looks for tells in phrasing.

The failure modes differ accordingly. Stylometric detectors have documented false positives against human writing, especially writing by non-native English speakers. A keyed watermark test only fires on text consistent with the keyed process, which over sufficient length is hard to produce by accident. Both approaches share the same blind spots at the margins: short text, heavy edits, and content from systems that never carried the signal.

And a Claude watermark check says nothing about ChatGPT or Gemini output by design. Keys are per-provider. Detection of everything is not what is being built; detection of Claude is.

For text, the watermark is in the content itself: copy the words and the signal comes along. For generated files of supported types, .png, .jpg, and .svg, Anthropic attaches a content credential instead, in its words a small, cryptographically signed note in the file's metadata, using the C2PA standard that camera makers and photo software use to record where an image came from. Anthropic draws the contrast itself: that metadata label is very different from a watermark, and the underlying image or content is not altered to encode it.

Two different scopes now exist and they are easy to merge by accident. Files Claude creates in the apps have carried a Content Credential since September 1, 2026, a date that comes from Anthropic's September 4 notice to administrators and appears on no public Anthropic page as of September 25, 2026; the help centre describes the same coverage for a supported file type "such as a PNG or JPEG" with no start date. Separately, the Claude Platform release notes for September 1, 2026 say supported image, video, and audio files produced through the code execution tool carry C2PA Content Credentials when retrieved through the Files API. Different surfaces, different file types, one standard.

They fail in opposite ways. C2PA metadata is robust evidence while it is present, and trivially lost: screenshots, re-encoding, and many upload pipelines strip it. App-created files are covered as described above; other platforms are a separate question, and Anthropic notes its file credentials may not be supported everywhere, adding that signed provenance metadata reaches a cloud platform only where that platform offers Claude's file generation features. The text watermark cannot be stripped in that sense at all, but it fades under exactly the thing metadata ignores, rewriting the content.

There is also a practical asymmetry worth knowing today, and it is the sharpest single contrast on this page. Because C2PA is an open standard, anyone can inspect a Claude-generated file with existing C2PA-aware tools, and Anthropic now runs its own free checker at claude.com/check-files: no sign-in, 17 listed image, video and audio formats, and in its own words "Your file stays on your device." The same page says "The tool does not check text." Files have a public checker; text has an application form.

Conflating the two produces confident nonsense in both directions: tools that promise to remove the text watermark by cleaning metadata, and verdicts that treat a missing manifest as proof of anything. A missing manifest proves nothing, and a cleaned file still contains every watermarked word.

This is not a complaint about reporters working from the only document that existed. It is a warning about what happens when those articles keep ranking after the primary source arrives.

• Translation is the biggest one. Early coverage suggested translation may knock the watermark out. Anthropic says the opposite for the case it addresses: a translation produced by Claude carries the watermark, because every word of it is Claude's choice.
• The hidden-character theory, still the most common claim on tool sites selling Claude watermark removal, is contradicted outright: nothing is added to the text and there are no hidden characters.
• The mechanism was described as token biasing by some outlets before Anthropic confirmed anything, and cited to the wrong research lineage. Anthropic's stated lineage is SynthID-Text from 2024 and Aaronson's 2022 proposal, and its watermark changes the randomness source rather than biasing Claude toward words it would not otherwise pick.
• At least one outlet named a specific current model as covered by the on-or-after August 2, 2026 threshold, and named the wrong one: the model in that report launched in 2025. The first two models Anthropic named, Fable 5.1 and Mythos 5.1, did not exist until September 1, 2026, three weeks after that coverage ran.
• The scope qualifier went missing almost everywhere. Anthropic's support article frames the threshold around models launched in the EU on or after August 2, 2026, while its technical post says watermarking is applied globally at launch because there is not yet a durable way to scope it by region. Both statements are Anthropic's; reporting that quotes only one of them reads as more absolute than the source.

A separate category of wrongness is still live in search results: pages claiming Claude does not watermark text at all, some of which sell stylometric AI detection as the alternative. That was defensible before August 2026 and is not now.

We cannot test Claude's watermark yet. Independent verification requires the detection API, which shipped on September 1, 2026 into a private preview this site does not have access to, and we found no independently validated public third-party detector to use instead. Publishing invented robustness percentages would be worse than publishing nothing, so this section is a commitment rather than a result.

• Official Anthropic detector: announced August 14, 2026, released September 1, 2026 as an API in private preview limited today to eligible organizations under EU law. No public interface, no pricing, and no date for wider access.
• Our access: none. We do not fall into any category Anthropic lists, so every robustness question on this page stays unmeasured by us until that changes.
• Independent experiments completed: one. The invisible-character census (96 Claude outputs, three model tiers, zero hidden characters found), published with data and scripts.
• Transformations tracked in our methodology, awaiting detection access: 20, the sixteen in the matrix below plus expansion and three tool-specific runs.
• Public dataset: not yet published. A results table only becomes real research once it holds real detector output; publishing empty rows as results would be exactly the SEO padding this page argues against elsewhere.
• Last updated: 2026-09-25.

The test matrix is built and waiting in our lab: original output, copy and paste, formatting changes, grammar correction, light manual editing, moderate rewriting, heavy rewriting, complete rewrite, summarization, expansion, Claude-produced translation, third-party translation of Claude's output, human and Claude mixtures, functional code, code comments, short answers, long-form prose, Grammarly, QuillBot, and LLM-based rewriting. Every result cell currently reads awaiting detection access, and they will be populated the day access exists, at a dedicated results page rather than folded into this one.

What we could measure without a detector, we already have: the character layer. The invisible-character census is published in the lab, and Anthropic's August 14 statement independently confirmed its conclusion.