Claude Watermark Detector: Private Preview, Not Public

There is still no Claude text watermark detector available to the public, but there is now one available to somebody. Rechecked 25 September 2026: Anthropic's detection API is in private preview as of 1 September, its help centre and its August explainer both updated to say so, and access runs through a request form rather than a public endpoint. No third-party tool and no research prototype anyone can run has appeared, for the structural reason in the next section.

So the honest answer splits by who is asking. A regulator, a newsroom, a fact-checking organization, an academic researcher, an educational institution, an EU civil-society group, or a company with its own Article 50 verification duty can apply and, if accepted, check a passage. A writer wondering whether their own draft is marked cannot, and neither can any product selling them that answer.

Anthropic's email to Claude for Work administrators, seen on 2026-09-04, compresses that eligibility list to "eligible EU organizations" and adds one thing no public page says: that "Anthropic does not see or store text submitted to" the detection API. Treat it as an official announcement rather than documentation, because Anthropic's public help page still does not say it when re-read on 2026-09-25, and neither it nor the 14 August 2026 news post says anything about whether submitted text is retained.

One Anthropic checker is public, and it checks files rather than text. The free Claude Content Checker at claude.com/check-files reads C2PA Content Credentials across 17 listed image, video and audio formats, runs in the browser, and states that your file "never leaves your device". Its own description of its limits is the sentence to keep: "The tool does not check text. Claude marks text with a watermark in the writing itself."

The tools that appear when you search for one fall into three groups, and none of them does what the name implies.

• Invisible-character scanners. They look for zero-width spaces, joiners, and byte-order marks. Real, useful for formatting hygiene, and unrelated to Anthropic's mark: the 14 August 2026 explainer rules the theory out directly, stating "Nothing is added to the text and there are no hidden characters."
• Generic AI detectors. They score writing style and perplexity. That is a guess about how text reads, not a decoded signal, and it is wrong in both directions on human and machine text alike.
• Removal tools claiming a before-and-after check. If nobody can detect the mark, nobody can demonstrate its removal either. The claim is unfalsifiable, which is the problem with it.

Statistical text watermarks are keyed. The scheme biases token selection during generation using a secret, and detection means running a statistical test that depends on knowing that secret and that scheme.

Google's SynthID-Text makes the shape of this concrete: it is open-sourced, ships in Hugging Face Transformers with a reference detector, and anyone can run the whole loop on their own model. That is possible precisely because the algorithm is public.

Anthropic has now described the mechanism at family level, calling it a version of the SynthID-Text approach, but it has published neither the exact scheme nor the key. Without those, an independent detector still has nothing to test against. The absence of third-party tools is therefore not a market failure or a lack of demand. It is the expected consequence of a keyed scheme whose key stays secret.

This also explains the shape of the independent research that has appeared. Analyses published on 12 August 2026 could rule out hidden characters, because characters are observable in the bytes. Neither could say anything about a token-selection watermark, and both said so. Two days later Anthropic confirmed both readings: the mark lives in keyed word selection, and nothing is added to the text.

Restricting text detection to verified expert users is something the EU Code of Practice Anthropic signed expressly permits. Almost every write-up treated the missing detector as a delay. The EU's Code of Practice on Transparency of AI-Generated Content, which Anthropic signed, describes something closer to a choice.

Its wording is that signatories may restrict access to detection mechanisms for free-form text where those mechanisms have lower reliability and robustness, and may produce misleading or low-confidence results, granting access instead to verified expert end-users such as regulators, law enforcement, media, fact-checkers, trusted flaggers, researchers, and civil society. Any restriction is to be limited in time, until more reliable detection emerges.

Read against that, an expert-access detector rather than a public one would be a compliant outcome, not a broken promise. That was written here in August with the caveat that Anthropic had not said it was the plan and it should not be reported as if it had.

On 1 September 2026 Anthropic said it. Line the two lists up and the resemblance is the point:

• The Code's category: "verified expert end-users such as regulators, law enforcement, media, fact-checkers, trusted flaggers, researchers, and civil society".
• Anthropic's eligibility: "regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, and EU civil society groups", plus enterprises with their own verification duty under the Act.
• How Anthropic's own notice to administrators summarises the same gate, seen 2026-09-04: detection is "limited today to eligible EU organizations", a compression its public help page still does not use when re-read on 2026-09-25.

Five of the Code's seven categories appear verbatim. That is not a coincidence and it was not a delay: the access model was available in the regulatory text weeks before the product shipped, for anyone who read the Code rather than the press release.

Two EU documents set the standard a detection API gets measured against, and they are not the same document. The Guidelines are the Commission's interpretation of Article 50, adopted 2026-07-20 as C(2026) 5054 final. The Code of Practice on Transparency of AI-Generated Content is voluntary, and Anthropic signed it.

The Guidelines treat marking and detection as one obligation with two halves. Paragraph 70 states that "Fulfilling only one element (e.g. for machine-readable marking of outputs without the means for their detection being available) will not suffice to comply with that provision."

Paragraph 75 says who detection has to reach. The provider "is obliged to ensure that the means of detection are available to the persons potentially exposed to the content", and under Article 50(5) the result has to be human-readable.

Paragraph 76 puts a provider's own detector second in line. Providers "must rely on publicly-available industry standard detection solutions", and only where such standards are absent, "in particular at the initial stage of the implementation of Article 50(2) AI Act for watermarking technologies", may a provider "rely on its own detection solution or on a third party or shared detection solution". That fallback "should be limited in time".

The Code of Practice pulls the other way, and only for text. Signatories "may restrict access to detection mechanisms associated to watermarking techniques for free-form text to the extent that they have a lower level of reliability and robustness", granting access instead to "verified expert end-users with a legitimate need". It adds that "Any restriction to the access will be limited in time until more reliable and robust detection mechanisms have emerged".

So a provider-run, expert-only text detector is a posture both documents anticipate at this stage of a rollout, and both describe as temporary. Neither supplies the date on which the temporary part ends.

Anthropic's own wording caps the strongest possible outcome: a detected mark indicates content may have been processed by Claude. Not that Claude wrote it, and not that a person did not.

The 14 August 2026 explainer sharpens the same ceiling. Detection can only answer "What is the likelihood this was partly written by Claude?", it "cannot distinguish 'Claude wrote this' from 'Claude heavily edited this'", and it "doesn't confirm whether the text was human-written."

Anthropic separately lists the conditions under which the mark may be absent or unrecoverable:

• Output from models released before marking
• Heavily edited, paraphrased, or translated text
• Watermarked text mixed into a longer document
• Very short passages

Anthropic lists one more condition that belongs to a different signal: provenance metadata on generated files can be lost to conversion, re-saving, or a screenshot. That is the C2PA layer, not the text watermark, which by Anthropic's own account adds nothing to the text that could be stripped.

The first condition on that list now has dates attached to it. Anthropic's 2026-09-25 email says Claude Opus 5 responses carry the watermark from September 14 (its 2026-09-04 notice to administrators had said September 9), and that Fable 5, Sonnet 5 and Opus 4.8 follow from 2026-09-30. A detection result on text from those models turns on when the text was generated rather than on the model name alone.

That list matters more than it looks, because it means a negative result will never be evidence of anything. A clean check would be consistent with human writing, with edited Claude output, with output from an older model, and with a passage too short to score.

Anyone planning to act on a future detector (an academic-integrity process, a newsroom check, a compliance workflow) should design around a tool whose positive result is a maybe and whose negative result is silence.

Three checks are genuinely available to you: invisible characters, C2PA metadata on generated files, and a generic AI detector's score. You are not without options. You are without one specific option that a lot of pages pretend to sell.

1. Invisible characters. Genuinely checkable, in your own browser, with an exact count per character. Just know what a hit means: nearly every invisible character has a mundane origin that predates chatbots by decades.
2. C2PA metadata on files. If Claude generated an SVG, PNG, or JPG, signed provenance metadata may be attached, and public tools verify it. A missing manifest proves nothing. Ordinary uploads destroy metadata routinely.
3. Detector scores, understood correctly. A generic AI detector tells you how the text reads to a statistical model. It is not a watermark check, it produces documented false positives, and it should never be the sole basis for an accusation.

On the first of those, we ran the measurement rather than repeating the theory: 96 outputs across three Claude model tiers, 19,364 words, every code point counted, against a control confirming the pipeline preserves invisible characters. Zero zero-width or bidirectional-format characters appeared.

So a Unicode scan on Claude output is worth running for formatting hygiene and will almost certainly come back clean. What it cannot be is a Claude watermark check, because the thing it looks for is not what Anthropic described.