Claude Text Watermark Explained: How It Works (August 2026)

The rollout, the news cycle, and the explanation happened on three different dates. Anthropic's marking policy took effect quietly: models launched on or after August 2, 2026, the day EU AI Act Article 50 transparency duties became applicable, support machine-readable marking at launch, per Anthropic's support documentation.

The support article was live by the evening of August 10, and press coverage followed within hours and through August 11: Interesting Engineering, then TechCrunch, Tech Times, Fortune, and others. Those stories, and everything written before August 14, could only describe what the watermark was, not how it worked, because Anthropic had not said. Early coverage largely relied on Anthropic's support documentation because the company had not yet published its technical explanation.

The technical explanation arrived on August 14: a post titled "How Claude's text watermark works" that names the mechanism family, walks through what survives editing, and announces a detection API. That post is the primary source for this page, and it makes a measurable share of what currently ranks for these queries outdated.

One more distinction worth keeping straight: the technical explanation is not the detection documentation. Anthropic's support article still promises details on detection mechanisms in forthcoming technical documentation, and as of August 15 it does not even link the August 14 post. What was published explains how marking works, not how checking will.

Claude generates text one token at a time. At each step there is a set of candidate next words, and many of the choices among them are low-stakes: important, useful, and valuable can all continue the same sentence without changing what it says.

Without watermarking, the model settles those close calls with randomness. With watermarking, Anthropic says the choice is settled by a secret key together with a few of the preceding words. The output is still natural text, and the words still look randomly chosen. But someone holding the key can recompute what the keyed process would have preferred at each step and check whether a passage's choices are consistent with it far more often than chance.

Anthropic's own analogy: play a board game, but replace the dice with successive digits of pi. The game plays out normally, and anyone who has the digits of pi can verify afterward that pi was steering the moves.

One property matters more than it sounds: the watermark changes the source of the randomness, not the shortlist. Anthropic is explicit that it does not push Claude toward words it would not otherwise have considered, giving the example that it would not make Claude reach for an obscure synonym like "nubilous" instead of overcast or grey. The candidates stay the candidates. Only the tiebreak changes.

Anthropic names its lineage directly: the method is a version of the SynthID-Text approach that Google DeepMind published in Nature in 2024, part of a family of keyed sampling watermarks going back to a 2022 proposal by Scott Aaronson.

• Confirmed by Anthropic: the mechanism family, the role of a key plus preceding words, that only the randomness source changes, no hidden characters, no extra tokens, no added cost, and internal testing showing no impact on content, creativity, or readability.
• Not published by Anthropic: the exact algorithm, how many preceding words seed the key, which SynthID-Text configuration it runs, how keys are managed, and the detector's math. The family is named; the specification is not.
• Our interpretation, labeled as such: naming SynthID-Text tells you the kind of detection to expect, a statistical score over many tokens rather than a lookup. It does not license copying DeepMind's published parameters or numbers onto Claude, and the Nature paper describes more than one configuration without Anthropic saying which it uses.

That last distinction runs through the rest of this page. Where a sentence below is Anthropic's, it is quoted or attributed. Everything else is context from the published research literature on this family of watermarks.

Anthropic's post is unusually blunt on this point: nothing is added to the text and there are no hidden characters. That single sentence retires most of what circulated before it.

• Zero-width characters: no. Not the mechanism, per Anthropic directly.
• Invisible Unicode spaces or variation selectors: no. Same sentence.
• Metadata attached to copied text: no. File metadata does not travel with ordinary plain-text copy/paste. A statistical watermark avoids that dependency because its signal is carried by the generated text itself.
• Em dashes or punctuation habits: no. Style tells are real observations about model writing, but no provider has ever named punctuation as a watermark, and Anthropic did not.
• Hidden HTML or formatting tricks: no. The signal survives paste-as-plain-text because it is the words, not the wrapper.

Claude output may still contain some of those things in the ordinary course of writing. They are just not the watermark, and removing them does not touch it.

Paste Claude's output into Google Docs, Word, an email, or a CMS and the thing the detector would score, the sequence of chosen words, arrives unchanged. Anthropic's support documentation says the mark travels with copied text for exactly this reason.

What copy and paste does lose is formatting and any file-level metadata. Neither carries the watermark, so losing them changes nothing. This is the practical difference between a statistical text watermark and every attachment-based scheme: there is nothing bolted on that a destination app could strip.

Copying is not transforming. The signal only starts to move when the words themselves change, which is the next section.

Anthropic's own summary: "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will." It adds, of the full-rewrite case, that it is arguable whether such text can still be described as AI-generated at all.

Between those poles, expect the signal to weaken as more of Claude's word choices are replaced. Anthropic publishes no thresholds, and any page telling you that changing some percentage of words removes the watermark is inventing a number that no publicly available detector can currently verify.

• Length matters. Short passages contain few choices and therefore little signal. Anthropic: as a passage increases in length, confidence about Claude's involvement increases too.
• Constraint matters. Factual passages watermark sparsely because there is often only one correct continuation. Anthropic's example: after "Isaac Newton's most famous work was called Principia", only "Mathematica" is right, so there is no choice to encode.
• Transformation type matters. A translation produced by Claude is fully watermarked, because every output word is Claude's choice. Heavy third-party rewriting sits at the other end of the spectrum.

Anthropic gives exactly two fixed points: light editing probably does not remove the mark completely, and a complete rewrite that replaces every word does. Everything below places specific, commonly-asked actions against those two poles plus the length and constraint factors Anthropic names. None of the middle is measured by anyone, including us, until the detection API ships.

• Copy/paste into any editor, email, CMS, or website: expected to survive. Evidence: Anthropic direct, the signal is the word sequence and copying preserves it exactly.
• Formatting changes (bold, headers, markdown, plain-text reflow, pasting into Notepad): expected to survive. Evidence: Anthropic direct, the mark lives in word choice, not in formatting or file structure.
• Typo and grammar correction on human-written text: little to nothing to detect in the first place. Evidence: Anthropic direct, addressing the proofreading case specifically.
• Light manual editing of Claude's own output, a handful of words changed: probably not removed. Evidence: Anthropic direct, this is the light-editing pole.
• Moderate rewriting, a meaningful minority of words replaced: may weaken. Evidence: our inference, interpolating between Anthropic's two stated poles. No published threshold exists.
• Heavy rewriting or thorough paraphrasing, most words replaced: substantially weakened, trending toward removed. Evidence: our inference from Anthropic's poles, consistent with independent robustness research on this watermark family, which is bounded by open reimplementations, not Claude itself.
• Complete rewrite, every word replaced: removed, on Anthropic's own account, with the caveat that Anthropic itself calls it arguable whether such text still counts as AI-generated at all.
• Summarizing Claude's output in your own words: functionally a heavy-to-complete rewrite. Evidence: our inference, since a summary by definition replaces most of the original wording.
• Expanding Claude's output with substantial human-written additions: the Claude-written stretches keep whatever signal they had; the added text carries none. Evidence: our inference from the mixed-document case Anthropic describes.
• Translation produced by Claude itself: fully watermarked. Evidence: Anthropic direct, every output word is Claude's choice.
• Translating Claude's output afterward with a person or a different tool: word choices are replaced, placing it at the rewrite end of the spectrum. Evidence: our inference; Anthropic states the Claude-translation case but not this direction explicitly.
• Functional code where only one output compiles or is correct: little to no watermark applied by design. Evidence: Anthropic direct.
• Code comments and documentation, where wording is free: watermarked like ordinary prose. Evidence: Anthropic direct.
• Removing zero-width characters, invisible Unicode, or other hidden formatting: no effect on this watermark. Evidence: Anthropic direct, nothing is added to the text and there are no hidden characters, so there is nothing in that category to remove.
• Very short passages of any kind, edited or not: weak signal regardless of transformation, simply because there are too few word choices to accumulate a detectable pattern. Evidence: Anthropic direct.

Nobody, including this site, can currently verify any row above by running a detector, because no public detector exists. Treat every "our inference" row as reasoning from Anthropic's own stated poles, not a measurement, and be skeptical of any source that states a specific percentage here.

This section gets asked about by tool name constantly, and the answer does not change by name: no third party, including this site, has run any of these tools' output against a real Claude watermark detector, because no public detector exists yet. What follows is reasoning from Anthropic's published statements, not experimental results, and it is labeled that way in every row.

• Grammarly and Word's built-in editor, used for spelling, grammar, and style suggestions: these change relatively few words, which resembles Anthropic's light-editing case. Not independently tested. Our reasoning: probably does not fully remove the mark, by analogy to light editing, not by measurement.
• Google Docs' built-in suggestions and spelling/grammar check: same category and same caveat as Grammarly and Word.
• QuillBot and other dedicated paraphrasing tools: these replace substantially more wording than a grammar check, closer to the heavy-rewriting end of the spectrum. Not independently tested. Our reasoning: likely weakens the signal more than light editing does, with no published threshold for how much.
• Asking ChatGPT or Gemini to rewrite Claude's output: if the other model regenerates the passage rather than lightly editing it, that approaches Anthropic's complete-rewrite pole, word by word. Not independently tested. Worth separating from the removal question: the output would be that other model's generation, carrying whatever watermark policy that model uses, if any, rather than a cleaned version of Claude's text.
• Dedicated translation tools applied after Claude has already produced text: covered in the transformation reference above as a rewrite-class case. Not independently tested.

Treat any site claiming a tested, verified percentage for how well Grammarly, QuillBot, ChatGPT, or Gemini defeats Claude's watermark as making a claim it cannot currently back up. That evidence does not exist publicly yet, for anyone.

Most of what is wrong about Claude's watermark online is not dishonest, it predates August 14 and never got corrected. These six keep resurfacing anyway.

• "Claude's watermark is a zero-width character." No. Anthropic states directly that nothing is added to the text and there are no hidden characters. A zero-width character is something a scanner can find and delete; this mark is a pattern across many word choices with nothing to point to in any single character.
• "Removing invisible Unicode removes Claude's watermark." No, for the same reason. A hidden-character cleaner, including this site's own, operates on a different layer entirely and cannot touch a signal that was never stored in a character.
• "Removing em dashes removes Claude's watermark." No. Punctuation preference is a real, separately documented stylistic tell in AI writing, but no provider, including Anthropic, has ever named punctuation as part of a watermarking mechanism. Deleting em dashes changes style, not the token sequence a detector would score.
• "Pasting into Notepad removes it." No. Notepad strips all formatting and any file metadata by design, which is exactly why it is a clean test of the underlying claim: the words that come out are identical to the words that went in, and the watermark lives entirely in which words those are.
• "An AI detector can tell you whether the watermark is gone." No. A generic AI-writing detector like the stylometric tools covered elsewhere on this site scores writing style without a key and without knowledge of Claude's watermark at all. It can return a confident-sounding verdict that has nothing to do with whether Anthropic's specific signal is present.
• "If a watermark is detected, Claude wrote the whole document." No. Anthropic is explicit that detection indicates likely Claude involvement and cannot distinguish text Claude wrote from text Claude heavily edited. A positive result is consistent with a thousand human words and one Claude sentence, not just with fully AI-authored text.

Character cleaning does nothing here. Removing zero-width characters, hidden Unicode, metadata, or unusual punctuation cannot address this watermark, because the signal is not stored in any of those. This site's own cleaner inspects and strips hidden Unicode, which remains useful against character-level marking that does exist in the wild, and for text hygiene. It does not, and cannot, remove Anthropic's statistical text watermark. Any tool that says otherwise is describing a different technology.

Transformation is the only category that plausibly affects a statistical signal, and the verified evidence base is one sentence long: light editing probably insufficient, complete rewrite sufficient. The middle is unmeasured, and it stays that way without detection access, because you cannot verify removal of a signal you cannot check for. Anthropic says detection relies on its watermark key. Without access to the necessary key or detection mechanism, a third party cannot directly reproduce Anthropic's official check from the public documentation alone.

So the honest answer to "can I remove it" is: partially, probably, at rewrite depths nobody can currently quantify, with success nobody can currently confirm. Distrust confident removal guarantees for as long as no public detector exists to hold them to.

No public Anthropic watermark detector or detection API is available as of August 15, 2026, and we found no independently validated public third-party detector. Anthropic's post says: "We will soon be offering a watermark detection API" and that it is working out the details of its implementation. That is a first-party commitment with no date, no interface, and no stated access rules. Anthropic's developer documentation and platform release notes contain no watermark detection endpoint, and its support article still lists detection details as forthcoming.

Anthropic says detection relies on its watermark key. Without access to the necessary key or detection mechanism, a third party cannot directly reproduce Anthropic's official check from the public documentation alone. The sites offering a Claude watermark checker today appear to be doing one of two other things: scanning for hidden characters, which Anthropic says are not the mechanism, or running a generic AI-writing classifier, which is a different technology entirely.

Anthropic is also specific about what its own detector will report when it exists: the likelihood that text was partly written by Claude. It will not recognize other providers' watermarks, because even providers using the same family of schemes hold different keys.

Anthropic's marking policy covers Claude Code by name, alongside the apps and the API. The technical post explains the limit that comes with that: where an exact output is required, where a different token would break the code or state a falsehood, the watermark is not applied.

Anthropic's summary is that code generally carries less watermarking than other kinds of text. Where code does have genuine freedom, Anthropic points to comments: word choice there is arbitrary, so comments are watermarked, with a negligible effect on the code itself.

The practical reading for developers: a short, tightly constrained snippet may carry little or no signal, while a longer generated file with comments and documentation carries more. Anthropic publishes no per-language or per-length figures, and this page will not invent any.

The proofreading case gets its own answer in Anthropic's post. If you write 1,000 words and Claude fixes the grammar, nearly all the words are yours, and in Anthropic's phrasing there is very little, if anything, for the watermark to attach to. Depending on length and edit depth, Claude's involvement might not be detectable at all.

Translation splits in two. A translation produced by Claude is watermarked, because every word of the output is Claude's choice. Text that started as Claude output and was then translated by a human or another tool has had its word choices replaced, which is the rewrite end of the editing spectrum; Anthropic publishes nothing more specific for that direction.

Mixed documents follow from the same logic: the signal lives in the stretches Claude wrote, diluted by everything humans wrote around them, with detectability depending on how much Claude text survives and how long it is.

Claude watermark detection, once it exists, will ask: is the specific keyed signal Anthropic embeds present in this text? A known signal, intentionally placed, statistically scored. Generic AI detectors ask a different question: does this text read like model output? No key, no embedded signal, just stylistic inference. Anthropic's own post draws this line, pointing to detection software like Pangram as the key-less alternative that looks for tells in phrasing.

The failure modes differ accordingly. Stylometric detectors have documented false positives against human writing, especially non-native English writers. A keyed watermark test only fires on text consistent with the keyed process, which over sufficient length is hard to produce by accident. Both approaches share the same blind spots at the margins: short text, heavy edits, and content from systems that never carried the signal.

And a Claude watermark check says nothing about ChatGPT or Gemini output by design. Keys are per-provider. Detection of everything is not what is being built; detection of Claude is.

For text, the watermark is in the content itself: copy the words and the signal comes along. For generated files of supported types, .png, .jpg, and .svg, Anthropic attaches a content credential instead, in its words a small, cryptographically signed note in the file's metadata, using the C2PA standard that camera makers and photo software use to record where an image came from. Anthropic draws the contrast itself: that metadata label is very different from a watermark. The underlying image or content is not altered to encode the credential; a cryptographically signed C2PA record is attached as metadata.

They fail in opposite ways. C2PA metadata is robust evidence while it is present and trivially lost: screenshots, re-encoding, and many upload pipelines strip it, and Anthropic notes its file credentials may not be supported on every platform. The text watermark cannot be stripped in that sense at all, but it fades under exactly the thing metadata ignores, rewriting the content.

There is also a practical asymmetry worth knowing today. Because C2PA is an open standard, anyone can already inspect a Claude-generated file for its credential with existing C2PA-aware tools, and Anthropic says it is building its own drop-a-file checker too. There is no equivalent public check for text, because Anthropic says detection relies on its watermark key. Files are checkable now; text is not.

Conflating the two produces confident nonsense in both directions: tools that promise to remove the text watermark by cleaning metadata, and verdicts that treat a missing manifest as proof of anything. A missing manifest proves nothing, and a cleaned file still contains every watermarked word.

This is not a complaint about reporters working from the only document that existed. It is a warning about what happens when those articles keep ranking after the primary source arrives.

• Translation is the biggest one. Early coverage suggested translation may knock the watermark out. Anthropic says the opposite for the case it addresses: a translation produced by Claude carries the watermark, because every word of it is Claude's choice.
• The hidden-character theory, still the most common claim on tool sites selling Claude watermark removal, is contradicted outright: nothing is added to the text and there are no hidden characters.
• The mechanism was described as token biasing by some outlets before Anthropic confirmed anything, and cited to the wrong research lineage. Anthropic's stated lineage is SynthID-Text from 2024 and Aaronson's 2022 proposal, and its watermark changes the randomness source rather than biasing Claude toward words it would not otherwise pick.
• At least one outlet named a specific current model as covered by the on-or-after August 2, 2026 threshold. No shipped Claude model has been named by Anthropic as carrying the mark, and the model in that report launched in 2025.
• The scope qualifier went missing almost everywhere. Anthropic's support article frames the threshold around models launched in the EU on or after August 2, 2026, while its technical post says watermarking is applied globally at launch because there is not yet a durable way to scope it by region. Both statements are Anthropic's; reporting that quotes only one of them reads as more absolute than the source.

A separate category of wrongness is still live in search results: pages claiming Claude does not watermark text at all, some of which sell stylometric AI detection as the alternative. That was defensible before August 2026 and is not now.

We cannot test Claude's watermark yet. Independent verification requires the detection API, which is announced but unreleased, and we found no independently validated public third-party detector to use instead. Publishing invented robustness percentages would be worse than publishing nothing, so this section is a commitment rather than a result.

• Official Anthropic detector: announced August 14, 2026, not released. No date, interface, or access rules published.
• Independent experiments completed: one. The invisible-character census (96 Claude outputs, three model tiers, zero hidden characters found), published with data and scripts.
• Transformations tracked in our methodology, awaiting detection access: 19, listed below.
• Public dataset: not yet published. A results table only becomes real research once it holds real detector output; publishing empty rows now would be exactly the SEO padding this page argues against elsewhere.
• Last updated: 2026-08-15.

The test matrix is built and waiting in our lab: original output, copy and paste, formatting changes, grammar correction, light manual editing, moderate rewriting, heavy rewriting, summarization, expansion, Claude-produced translation, third-party translation of Claude's output, human and Claude mixtures, functional code, code comments, short answers, long-form prose, Grammarly, QuillBot, and LLM-based rewriting. Every result cell currently reads awaiting detection access, and they will be populated the day access exists, at a dedicated results page rather than folded into this one.

What we could measure without a detector, we already have: the character layer. The census that found zero hidden characters in 96 Claude outputs is published in the lab with its data and scripts, and Anthropic's August 14 statement independently confirmed its conclusion.