Free · No sign-up · Open source

Claude Watermark Remover

Claude has been watermarking what it writes since 2 August 2026. This tool rewrites text with a non-Claude model, and inspects or strips the C2PA credentials and AI metadata inside files — telling you which parts of that can be verified and which cannot, instead of inventing a score.

  • No sign-up
  • Nothing stored by the app
  • 13 file formats
  • No fake detector claims
Claude watermark remover

Free · No sign-up · Nothing stored

Meaning-preserving rewrite by a non-Claude model. Usually a few seconds.0 / 12,000 characters
Rewrite method

Start here

Claude started watermarking its own writing on 2 August 2026

This is new, which is why so much advice about it is wrong. On 2 August 2026 Anthropic began embedding an imperceptible watermark into text that Claude generates. It signed the EU AI Act transparency code earlier in the year, and this is how it complies.

Three things about it are worth knowing before anything else:

  • It is applied inside the model. So it does not matter which door the text came through — the Claude apps, the API, Claude Code, Cowork, or Claude bought through AWS, Google Cloud or Microsoft Foundry. Same mark, worldwide.
  • There is no off switch. No account setting, no prompt that skips it. Models released before that date are still being brought into scope, so older output may carry nothing at all.
  • Text and files are marked in completely different ways. Text gets a statistical mark made of word choices. Files get a signed C2PA credential attached to them. The difference matters enormously, and it is the reason one of them can be verified and the other cannot.
Infographic: Claude applies its watermark at the model level across apps, API, Claude Code and cloud resellers; text output carries highlighted word choices, files carry a C2PA seal, and there is no setting to switch it off
One mark, every surface — and two different mechanisms. The word-choice mark in text and the signed credential in files are unrelated technologies that happen to share a name.

The mechanism

How an AI text watermark works, in plain English

Start with what it is not. It is not a hidden character. Not an invisible space, not a zero-width symbol, not a secret string buried in the paragraph. If it were any of those, deleting it would be trivial and this page would be three sentences long.

It is made of the words themselves. Here is the idea, drawn from the published research on this class of watermark rather than from Anthropic’s own implementation, which has not been disclosed.

Every time a language model writes a word, it is picking from a ranked list of candidates. After “the results show a consistent…” the words pattern, trend, effect and signal are all perfectly reasonable. A watermarked model uses a secret key to split that candidate list into two halves at every single position, and then leans very slightly toward one half.

Any individual word is an ordinary choice. Nothing reads oddly, nothing is misspelled, no one can see it. But across a few hundred words that small lean accumulates into an imbalance, and someone holding the key can measure it.

Infographic showing how a statistical text watermark works in five steps: a prompt, the model's ranked token choices, the resulting pattern distributed across the text, a rewrite by a non-Claude model, and keyed verification that only the key holder can perform
A conceptual model, not Anthropic’s disclosed implementation. The published scheme this is based on is the green-list / red-list method of Kirchenbauer et al., linked in the sources at the foot of the page.

Two consequences follow from that, and between them they explain nearly everything else on this page.

  • It survives copy-paste. Reformatting, changing the font, retyping it, running find-and-replace — none of it touches the mark, because the mark is the words. There is no character to strip.
  • Rewriting is the one thing that disturbs it. Replace the word choices and you replace the thing carrying the signal. That is why this tool is a rewriter rather than a scrubber, and why a very short passage may carry too little signal to measure in the first place.
How a token-level watermark is embedded in Claude textThree stages. First, a secret key splits the vocabulary into a green half and a red half at every word position. Second, when Claude picks the next word it is nudged slightly toward the green half, so an ordinary-looking sentence ends up containing more green words than chance would predict. Third, across a few hundred words that imbalance becomes statistically measurable, but only to someone holding the key.STAGE 1A secret key splits the vocabulary in twoAt every word position, a keyed hash sorts every possible next word into one of two halves.GREEN HALF — favouredapproachmethodshowsresultsclearRED HALF — suppressedtechniquewayrevealsfindingsobviousTHE SPLIT IS NOT FIXEDIt is re-derived at every wordfrom the preceding context anda key only Anthropic holds.Without that key the pattern isindistinguishable from ordinaryword choice.STAGE 2Generation leans toward the green halfEach individual choice stays natural. Nothing here reads as odd, and nothing is hidden in the characters.Theapproachshowsaclearsetofresults5 of 8 words came from the favoured half. Over one sentence that is meaningless — coin flips do that all the time.STAGE 3Across a few hundred words, the imbalance stops being luckThat is the whole watermark — a statistical lean spread across the text, not a hidden character.Which is why deleting invisible characters does nothing to it, and why re-writing the words does.
The same idea, labelled precisely. The signal is spread across hundreds of ordinary word choices, so there is no string to find and nothing to delete. Replacing the words is the only operation that reaches it.

The honest answer

Can anyone check whether your text is watermarked? Not yet

Not us, and not any other public tool. Reading the mark requires the secret key, and Anthropic holds it. The company has said it will support third-party detection and that technical documentation is forthcoming. That documentation has not been published.

So when a page offers you a “Claude watermark detector” and hands back a confident percentage, one of exactly two things is happening:

  • It is scanning for invisible Unicode characters. Those are real and worth removing, but they are a different mark entirely. A clean result there tells you nothing about the statistical one.
  • It is running a commercial AI-writing detector. Those guess from style. They are unreliable in both directions, including false accusations against people who wrote every word themselves.

We could put a score on this page in an afternoon. It would be invented. And the moment Anthropic publishes its detector, every made-up number on the internet becomes checkable — and wrong. So instead of a score, this tool tells you which parts of the job it can prove and which it cannot, operation by operation.

Infographic: the key that reads Claude's watermark is held by Anthropic; public detectors instead measure invisible characters or writing style, which is not the same signal
Every public “detector” is measuring something else. That is not a criticism of the engineering. It is arithmetic: without the key there is nothing to read.

Disambiguation

Three different marks get called “the Claude watermark”

Most of the confusion around this topic comes from collapsing three unrelated things into one name. They live in different places, need different fixes, and — the part that matters most — differ in whether you can confirm the fix worked.

The three marks people call a Claude watermarkA comparison of three distinct marks. The statistical text watermark lives in word choices, applies to all text from Claude models launched on or after 2 August 2026, is addressed by rewriting, and cannot be independently verified as removed. C2PA provenance metadata lives in a signed manifest inside supported files and can be verifiably stripped. Invisible Unicode characters are editor artifacts rather than Claude’s watermark, and can also be verifiably removed.Three different things get called “the Claude watermark”They live in different places and need different fixes. Only two of the three can be verified after the fact.1Statistical text watermarkSpread across the word choices themselvesWHEN IT APPLIESAll text from Claude models launched on or after 2 Aug 2026HOW IT IS ADDRESSEDRewrite the text with a non-Claude modelNOT VERIFIABLENo public detector exists2C2PA provenance metadataA signed manifest inside the fileWHEN IT APPLIESSupported files Claude generates, such as .png, .jpg and .svgHOW IT IS ADDRESSEDInspect the manifest, then strip itVERIFIABLERe-inspect and confirm3Invisible Unicode charactersActual code points sitting in the textWHEN IT APPLIESEditors and copy-paste, not Claude's watermarkHOW IT IS ADDRESSEDStrip the code pointsVERIFIABLERe-inspect and confirm
Only two of the three are verifiable. A tool that scans for invisible Unicode and then reports on “the Claude watermark” is answering a question you did not ask. A clean Unicode result tells you nothing at all about the statistical mark.

The tool

What we built, and how it helps you

Three marks, three jobs. For each one, the tool does the work and then tells you whether the result is something it can prove or something it cannot.

  • Invisible characters — verified. Zero-width spaces and joiners are found, removed and counted, then the text is re-scanned to confirm. You get the exact list of what came out. This is the only mark most “detectors” are actually detecting.
  • Word choices — best effort. The passage is rewritten by a model from a different vendor, with four methods to choose from. Never by Claude: rewriting Claude’s output with Claude would re-apply the very statistics the rewrite is meant to disturb. Nobody can measure the result, so we do not pretend to.
  • File credentials — verified. Upload an image or a document and the tool shows you the C2PA manifest and AI metadata it found before it changes anything. It then writes a new file and re-inspects it, leaving your original untouched.

And what it deliberately does not do: no cleaned percentage, no removal score, no “99% human” badge. Not because the number would be hard to print, but because it would be fiction. It is free, there is no sign-up, nothing is intentionally stored, and the whole thing is open source if you would rather run it yourself.

Infographic comparing the three marks: invisible characters marked verified, word choices marked best effort, and file credentials marked verified
Two of the three can be re-checked after the fact. The middle one cannot, by anyone, and the results panel says so every time rather than rounding it up into a score.

The method

How to remove a Claude watermark in three steps

  1. 1

    Paste text you own

    Open the rewrite tab above and paste up to 12,000 characters. Nothing is stored by the application. If the passage is long, run it in sections so you can check each one properly.

  2. 2

    Choose a method and run it

    Paraphrase is the right default. The text is cleaned of invisible characters, rewritten by a model from a different vendor, then cleaned again. Facts, names, numbers and citations are pinned by instruction.

  3. 3

    Read it before you use it

    Check every number, quotation and link. Rewrite models paraphrase confidently and occasionally wrongly. The report tells you exactly which characters were removed and reminds you what could not be verified.

Under the hood

What happens to your text, in order

The pipeline follows the documented recipe of the open-source watermarks-remover project, which this tool runs as a pinned container: clean, rewrite, clean again, then report honestly.

The Layer A, Layer B, Layer A cleanup pipelineText passes through three stages. Layer A strips invisible Unicode characters and the result is verifiable. Layer B rewrites the text with a model from another vendor to replace the word choices carrying the statistical watermark, and this step is best effort because no public detector exists. Layer A then runs a second time, because the rewrite model is itself a language model and introduces its own artifacts.What happens to your text, in orderThe second Unicode pass is not redundant. It exists because the rewrite model adds artifacts of its own.YourtextLayer AStrip invisible UnicodeZero-width spaces, bidi controls,exotic whitespaceVerifiedLayer BRewrite with a non-Claude modelReplaces the word choices thatcarry the signalBest effortLayer A againStrip Unicode once moreThe rewrite model is an LLM too,and adds its own artifactsVerifiedWHAT YOU GET TOLD AFTERWARDSThe exact code points removed, counted on both passes — and a plain statement that the rewrite is best effort.WHAT NO TOOL CAN TELL YOUWhether the statistical watermark is gone. Reading it needs Anthropic’s key, and Anthropic has not published adetector. Any tool showing you a confident “watermark removed” score for pasted text is inventing it.
The second Unicode pass is not redundant. The rewrite model is itself a language model and introduces its own invisible-character artifacts, so the text is re-cleaned after it comes back.

Choosing

Which rewrite method should you use?

These are the standard attacks described in the watermark-robustness literature, not invented labels. They trade token churn against faithfulness to your original meaning.

Comparison of the four rewrite methods available in the Claude watermark remover
MethodCostWhat it doesWhen to use itMeaning drift
Paraphrase1 model passEvery sentence re-worded and re-structuredThe default. Best balance of token churn against staying faithful to your meaning.Low
Humanize1 model passParaphrase plus deliberate rhythm variationWhen the source has the uniform cadence that makes generated prose recognisable.Low
Back-translate2 model passesThrough French, then back to EnglishA harder reshuffle of word choices. Watch for idioms that come back slightly odd.Medium
Structural2 model passesReduced to an outline, then rewritten from itThe most thorough reshuffle. Re-read the output properly before using it.High

Images and documents

Claude marks files too, and that mark you can actually verify

Most pages competing for this search treat “Claude watermark” as a text-only problem. It is not. When Claude produces a supported file — .png, .jpg, .svg and others — it attaches signed C2PA provenance metadata, the same Content Credentials standard used across the industry. Anthropic describes it as a way to tell that a file was processed by Claude, and whether it has been tampered with since.

This is a genuinely different situation from the text watermark, and a much more satisfying one. A C2PA manifest is a real structure sitting inside the file. You can open it, you can remove it, and you can re-inspect the file afterwards to confirm it is gone. That is why the file tab shows you what it found before it changes anything, and why it writes a new file rather than editing your original.

Infographic showing the layers inside a Claude-generated image file: pixels, EXIF, XMP and a C2PA manifest, and the inspect-then-strip step the tool performs
A real structure you can look at, remove, and re-check. Unlike the text mark, nothing here has to be taken on trust — the tool shows you the manifest before and after.

The cleaner handles TXT, Markdown, HTML, SVG, PNG, JPG, JPEG, WebP, PDF, DOCX, ODT, HEIC and AVIF, up to 12 MB. It also strips AI-related EXIF and XMP fields and generator tags, and it can keep ordinary metadata such as camera settings if you tick that option. One caveat worth stating plainly: stripping a hard-bound manifest does not address soft-binding techniques that re-link a file to a remote manifest, and pixel-level image watermarks are a separate problem this tool does not claim to solve.

The case nobody covers

When Claude marks writing that was yours to begin with

Here is the scenario that brings a lot of people to this page, and that almost no other page addresses. You wrote something yourself. You asked Claude to proofread it, tighten it, translate it, or fix the grammar. The text that came back carries a Claude mark — because Claude processed it — even though the ideas, the argument and most of the words are yours.

Anthropic is explicit about this limitation. In its own words, a detected mark indicates content may have been processed by Claude, and Claude may not be the original author: people often use it to proofread, translate, summarise or convert. The mark is a processing signal. It is not an authorship verdict, and it is not evidence of misconduct.

That distinction matters most in exactly the settings where it is most likely to be ignored — a university integrity process, an editor’s inbox, a client relationship. If you are on the receiving end of an accusation based on a mark, the strongest thing you have is not a cleaned document. It is your drafts, your version history and your ability to talk through your own argument. Clean the file if you have reason to; keep the evidence of authorship either way.

Infographic in three steps: your own draft, Claude proofreading it with correction marks, and the same page coming back marked anyway — a processing signal, not authorship
A mark means Claude touched the text. It does not mean Claude wrote it — and Anthropic says so itself.

Before you use it

Should you remove it? A straight answer

Reasonable uses

  • Rewriting a draft you own or commissioned into your house voice.
  • Cleaning provenance metadata from your own images before publishing them.
  • Stripping invisible characters that break your CMS, diffs or search indexing.
  • Restoring a document that is substantially your own writing after Claude proofread it.
  • Privacy hygiene on content you control and are authorised to edit.

Things this does not make okay

  • Submitting AI-generated work as your own where disclosure is required.
  • Coursework or research output under an academic integrity policy.
  • Regulated filings, legal documents or anything with a statutory disclosure duty.
  • Content on a platform whose terms require AI labelling.
  • Anything you would not be comfortable explaining if asked directly.

No tool can make the second column legitimate, and any page implying otherwise is selling you a risk it will not share. The technical capability and the decision to use it are separate questions, and only one of them is ours to help with.

Evidence

Does rewriting actually weaken the watermark?

The honest answer has two halves, and most pages give you only the flattering one.

The supporting half. Watermarks of this class are applied token by token as text is generated, because that is what streaming output requires. The published research on this family of schemes treats paraphrasing as the canonical attack precisely because rewriting replaces the token choices the signal is made of. Anthropic itself lists heavy editing, paraphrasing, translation, mixing with other writing, and short passages among the reasons a mark may not be detectable. That is the vendor describing the limits of its own system, which is about as good as evidence gets here.

The limiting half. Nobody can currently measure the result. Verification needs Anthropic’s key. Any specific number — “removes 99%”, “changes 70% of tokens so detection fails” — is unverifiable by whoever published it. Research also continues on watermarks designed to survive paraphrasing, so the picture may shift as newer schemes deploy.

The reasonable position: rewriting is the only technique that engages with the actual mechanism, more thorough rewriting disturbs it more, and no one can hand you a certificate. That is why this tool reports what it changed rather than scoring what it cannot see.

Infographic weighing what supports rewriting as a countermeasure against what limits it: the mark lives in word choices and rewriting replaces them, but nobody outside Anthropic can measure the result
The only technique that engages the mechanism. Also the one nobody can currently measure, which is why this page gives you the reasoning instead of a number.

Privacy

What happens to what you paste

The application does not intentionally retain your text or files. Uploads are handled by a private container that is never exposed to the browser, and rewriting is done by the model configured on the server — the API key never reaches your browser.

What that statement cannot cover: the retention policy of the model provider, reverse-proxy logs, and backups. For genuinely sensitive material, the entire tool is open source and can be self-hosted against a local model so nothing leaves your own network.

Questions

Claude watermark remover FAQ

Does Claude actually watermark its text?

Yes, since 2 August 2026. Anthropic signed the EU AI Act Article 50(2) Code of Practice on Transparency and now embeds an imperceptible watermark into text generated by Claude models launched on or after that date. It is applied at the model level, so it is present whichever Claude surface produced the text — the API, the Claude apps, Claude Code, Cowork or Tag — and worldwide, including when Claude is accessed through AWS, Google Cloud or Microsoft Foundry. Models released before that date are still being brought into scope, and there is no user-facing switch to turn marking off.

How does a text watermark work if there is nothing visible in the text?

It is carried by word choice rather than by hidden characters. In published schemes of this class, a secret key sorts the vocabulary into two halves at every word position, and the model is nudged to pick from one half slightly more often. Any individual word is an ordinary choice. Across a few hundred words the imbalance becomes statistically measurable to someone holding the key. That is why the mark survives copy-paste — it is made of the words themselves, not of anything you could strip out.

Can this tool tell me whether my text is watermarked?

No, and neither can any other independent tool today. Reading the signal requires the secret key, which Anthropic holds. Anthropic has said it will support third-party detection and that technical documentation is forthcoming, but that documentation has not been published. Several tools currently ranking for this query advertise a Claude watermark detector. What they actually detect is invisible Unicode characters, which is a different thing entirely and is not the mechanism Anthropic described.

What does the rewrite actually do, then?

It replaces the word choices that carry the signal. Because the watermark lives in which tokens were selected, genuinely rewriting those tokens is the only countermeasure that engages with the mechanism at all. Anthropic itself lists heavy editing, paraphrasing, translation and mixing with other writing among the reasons a mark may no longer be detectable. This tool automates that with a model from a different vendor, and reports the result as best effort rather than as proof.

Which rewrite method should I choose?

Start with Paraphrase. It re-words and re-structures every sentence while staying closest to your meaning, and it is the method with the strongest support in the research literature. Humanize adds deliberate rhythm variation. Back-translate routes the text through French and back, which reshuffles word choices harder at the cost of some idiom drift. Structural reduces the passage to an outline and rewrites from it — the most thorough reshuffle and the most meaning drift, so re-read the output carefully. All four preserve facts, names and numbers by instruction, but you should still check them.

Will this get my text past an AI detector like Turnitin or GPTZero?

That is a different question with a different answer, and we will not promise it. Commercial AI detectors do not look for Anthropic's watermark — they cannot, because they do not have the key. They guess from writing style, and they are unreliable in both directions, including false accusations against human writing. Rewriting may change what such a tool reports, but neither we nor anyone else can guarantee an outcome, and using this to misrepresent authorship where disclosure is required is not something the tool can make legitimate.

Does a Claude mark mean Claude wrote it?

No, and this is the limitation people most often get wrong. Anthropic states plainly that a detected mark shows content may have been processed by Claude, not that Claude authored it. If you write something yourself and ask Claude to proofread, translate or summarise it, the output can carry a mark even though the ideas and the substance are yours. A mark is a processing signal, not an authorship verdict, and it should never be treated as evidence of misconduct on its own.

Does the absence of a mark mean text is human-written?

No. Anthropic lists several reasons genuinely AI-generated text may carry no detectable mark: it came from a model released before marking was supported, it was heavily edited or translated, it was mixed into other writing, or the passage is simply too short to carry a reliable signal. Absence of a mark is not evidence of human authorship, just as presence of one is not proof of AI authorship.

What about images, PDFs and Word documents?

Files use a completely different mechanism. Claude attaches signed C2PA provenance metadata — Content Credentials — to supported file types such as .png, .jpg and .svg. Unlike the text watermark, this is a real, inspectable manifest, so the tool shows you exactly what it found before changing anything and you can verify the result afterwards. It also strips AI-related EXIF and XMP fields and generator tags, and it can preserve ordinary metadata such as camera settings if you want that kept.

Is my text stored or logged?

The application does not intentionally retain what you paste or upload. Text is sent to the rewrite model configured on the server to be processed, and files are handled by a private container that is never exposed to the browser. That statement cannot override the retention policies of the model provider, reverse-proxy logs, or backups, so treat genuinely sensitive material accordingly — the whole tool is open source and can be self-hosted against a local model if you need nothing to leave your own network.

Is it legal to remove a Claude watermark?

It depends entirely on what you are doing, and the honest answer is that the tool cannot make that judgement for you. Cleaning provenance metadata from your own images, stripping invisible characters that break your CMS, or rewriting a draft you own into a house voice are ordinary editorial and privacy tasks. Presenting AI-generated work as your own where disclosure is required — coursework, regulated filings, platform terms — is not, and no tool changes that. Use this on content you own or are authorised to edit.

Is this Claude watermark remover free?

Yes. There is no sign-up, no account and no payment. The interface, the cleanup service and the deployment configuration are open source, so you can also run the whole thing on your own infrastructure and point it at your own model if you would rather nothing left your network.

References

Sources

Every factual claim on this page about what Anthropic marks, and what a mark does and does not prove, comes from Anthropic’s own documentation. It is linked here so you can check it rather than take our word.

Published 16 August 2026 · Last reviewed 17 August 2026. Anthropic began marking Claude text on 2 August 2026; this page is updated as its detection documentation is published.

Clean text you own, without the fake certainty

Rewrite with a non-Claude model, strip what is verifiably strippable, and get told honestly which is which.

Open the Claude watermark remover