Does Claude Watermark Its Text?

Yes. On 11 August 2026 Anthropic updated its help centre to confirm that text produced by supported Claude models carries an invisible, machine-readable watermark. It applies worldwide, across every Claude surface, and there is no switch to turn it off — the marking happens inside the model.

This is a genuine change, and most of what was written about "Claude watermarks" before August 2026 — including the earlier version of this page — is now out of date.

What Anthropic has confirmed

From the official help centre article:

• Claude models launched on or after 2 August 2026 support marking at launch; earlier models are being retrofitted.
• Marking covers the Claude API, Claude, Claude Code, Claude Cowork and Claude Tag, plus supported models accessed through AWS, Google Cloud and Microsoft Foundry.
• It applies wherever Claude is offered, worldwide — not only in the EU.
• The watermark "is part of the text", so it "will travel with the text when it's copied and pasted elsewhere, and may persist through some editing".
• Separately, generated files such as .png, .jpg and .svg carry signed C2PA provenance metadata.

Why now

Article 50 of the EU AI Act took effect on 2 August 2026, requiring providers of generative AI systems to make AI-generated content detectable through machine-readable marking. Penalties run to €15m or 3% of global annual turnover. Anthropic signed the associated Code of Practice on Transparency, as did Google, Meta, Microsoft and OpenAI — around 190 organisations in total by the end of July.

Nothing in the regulation required marking outside Europe. Anthropic applied it globally anyway.

It is not hidden characters

This is the part almost every article gets wrong, and it decides whether any "watermark remover" can help you.

The first reaction to the announcement was that Anthropic must be inserting secret characters or odd spacing. It is not. Anthropic has described what the mark does without publishing the method, but the established technique — and the one the mark's described behaviour matches — is green-list token biasing, from research by John Kirchenbauer and colleagues.

When a language model writes, it usually has several plausible options for the next token. A secret key, seeded by the text written so far, sorts those options into two temporary groups, conventionally called green and red. The model is not forced to choose from the green group; the probabilities are simply tilted that way. The groups are reshuffled for every subsequent token.

One green choice means nothing. A handful means nothing. Across several hundred words, the proportion of green tokens sits far above chance, and anyone holding the key can measure it. The watermark is not in the text as an extra character — it is the text, expressed in which ordinary words got chosen.

What this means for watermark removers

Bluntly: stripping invisible characters does not remove Claude's watermark. There is no character to strip. Any tool — this site's included — that claims a one-click clean defeats it is either misinformed or lying to you.

The cleaners here remove zero-width characters, exotic spaces and smart punctuation. That is worth doing for real reasons: those characters break search, logins, URLs, CSV parsing and code. It is simply a different problem from the model-level watermark, and conflating the two is how people end up falsely confident.

What Anthropic says does defeat detection

The help centre's own limitations section is the most useful passage in it. Content generated by Claude may carry no detectable mark if:

• It came from a model released before marking was supported.
• The text has been heavily edited, paraphrased, translated, or mixed into other writing.
• The passage is very short, leaving too little text for a reliable signal.
• For files, the metadata was stripped through format conversion, re-saving, screenshots, or similar.

So: substantive rewriting weakens or destroys the text signal, because it changes the token choices the signal is made of. Translation does the same. Short passages never carried a reliable signal to begin with. And file provenance metadata really is removable — the C2PA metadata remover does it by re-encoding the image in your browser, which is the same mechanism as Anthropic's "format conversion, re-saving".

Note what is absent from that list: deleting invisible characters.

Automating the first item is what the Claude text watermark remover does — substituting synonyms, swapping the connectives models overuse and toggling contractions, then reporting what share of the original words it replaced. That share is the only honest metric available, since the detection threshold is not public. It is disruption rather than a guaranteed erase, and any tool telling you otherwise is guessing.

What a detected mark actually proves

Less than people will assume, and this matters more than the removal question.

Anthropic is explicit that a detected mark shows content "may have been processed by Claude" — not that Claude wrote it. People use Claude to proofread, translate, summarise and convert files. A student who wrote an essay unaided and ran it through Claude for grammar can carry the mark. So can a non-native English speaker who used it to tidy their phrasing, and so can someone who pasted a paragraph in to check it read clearly.

The inverse also holds: absence of a mark proves nothing, because older models, heavy editing and short passages all produce clean text.

The predictable failure mode is a school or employer treating a positive result as proof of misconduct. It is not proof. It is one signal about processing, with a documented list of ways it produces both false negatives and misleading positives. If you are on the receiving end of such an accusation, the limitations section of Anthropic's own documentation is the thing to cite.

Checking your own text

You cannot check for the embedded watermark yourself — detection requires the key, and Anthropic says tooling for third parties is still "forthcoming". What you can check in two seconds is whether your text carries invisible unicode characters, which is a separate and much more common problem. Paste it into the invisible character detector and read the Analyze tab.

Related

Does ChatGPT watermark its text? · Invisible unicode characters explained · C2PA metadata remover