Claude Watermark Detector: There Isn't One Yet

There is no Claude watermark detector available to the public. Rechecked 12 August 2026, ten days after Anthropic's marking rollout: no Anthropic tool, no third-party tool, no research prototype anyone can run.

The tools that appear when you search for one fall into three groups, and none of them does what the name implies.

• Invisible-character scanners. They look for zero-width spaces, joiners, and byte-order marks. Real, useful for formatting hygiene, and unrelated to Anthropic's mark, which Anthropic has never described as character-based.
• Generic AI detectors. They score writing style and perplexity. That is a guess about how text reads, not a decoded signal, and it is wrong in both directions on human and machine text alike.
• Removal tools claiming a before-and-after check. If nobody can detect the mark, nobody can demonstrate its removal either. The claim is unfalsifiable, which is the problem with it.

Statistical text watermarks are keyed. The scheme biases token selection during generation using a secret, and detection means running a statistical test that depends on knowing that secret and that scheme.

Google's SynthID-Text makes the shape of this concrete: it is open-sourced, ships in Hugging Face Transformers with a reference detector, and anyone can run the whole loop on their own model. That is possible precisely because the algorithm is public.

Anthropic has published neither. Without the mechanism or the key, an independent detector has nothing to test against. The absence of third-party tools is therefore not a market failure or a lack of demand. It is the expected consequence of an undisclosed scheme.

This also explains the shape of the independent research that has appeared. Analyses published on 12 August 2026 could rule out hidden characters, because characters are observable in the bytes. Neither could say anything about a token-selection watermark, and both said so.

Almost every write-up treats the missing detector as a delay. The EU's Code of Practice on Transparency of AI-Generated Content, which Anthropic signed, describes something closer to a choice.

Its wording is that signatories may restrict access to detection mechanisms for free-form text where those mechanisms have lower reliability and robustness, and may produce misleading or low-confidence results, granting access instead to verified expert end-users such as regulators, law enforcement, media, fact-checkers, trusted flaggers, researchers, and civil society. Any restriction is to be limited in time, until more reliable detection emerges.

Read against that, an expert-access detector rather than a public one would be a compliant outcome, not a broken promise. Anthropic has not said this is its plan, and it should not be reported as if it had.

Anthropic's own wording caps the strongest possible outcome: a detected mark indicates content may have been processed by Claude. Not that Claude wrote it, and not that a person did not.

Anthropic separately lists the conditions under which the mark may be absent or unrecoverable:

• Output from models released before marking
• Heavily edited, paraphrased, or translated text
• Watermarked text mixed into a longer document
• Very short passages
• Files whose metadata was stripped by conversion, re-saving, or a screenshot

That list matters more than it looks, because it means a negative result will never be evidence of anything. A clean check would be consistent with human writing, with edited Claude output, with output from an older model, and with a passage too short to score.

Anyone planning to act on a future detector (an academic-integrity process, a newsroom check, a compliance workflow) should design around a tool whose positive result is a maybe and whose negative result is silence.

You are not without options. You are without one specific option that a lot of pages pretend to sell.

1. Invisible characters. Genuinely checkable, in your own browser, with an exact count per character. Just know what a hit means: nearly every invisible character has a mundane origin that predates chatbots by decades.
2. C2PA metadata on files. If Claude generated an SVG, PNG, or JPG, signed provenance metadata may be attached, and public tools verify it. A missing manifest proves nothing. Ordinary uploads destroy metadata routinely.
3. Detector scores, understood correctly. A generic AI detector tells you how the text reads to a statistical model. It is not a watermark check, it produces documented false positives, and it should never be the sole basis for an accusation.

On the first of those, we ran the measurement rather than repeating the theory: 96 outputs across three Claude model tiers, 19,364 words, every code point counted, against a control confirming the pipeline preserves invisible characters. Zero zero-width or bidirectional-format characters appeared.

So a Unicode scan on Claude output is worth running for formatting hygiene and will almost certainly come back clean. What it cannot be is a Claude watermark check, because the thing it looks for is not what Anthropic described.