Claude Watermark Remover

Is this a Claude watermark checker or a remover?

It is both a Claude watermark checker and a remover, and the check runs first. Paste your text and the tool reports what it found before it changes anything: every hidden character, named by its Unicode code point, with a count and a position in the text.

Three of those checks go past what a character stripper reports. It decodes hidden payloads, so a message smuggled inside tag characters or variation selectors comes back as readable text instead of a count. It reads the clipboard markup a chat interface leaves behind in a copied answer. And it inspects an image for a C2PA provenance manifest, which is a separate signal from anything carried in text.

One check no tool can run, this one included. Nothing checks text for Anthropic's statistical watermark. Verifying it takes a key Anthropic has not released to anybody. A checker that hands back a Claude watermark score for your prose is guessing, and the honest report names what it actually read and stops there. The rest of this page covers how that real watermark works instead.

Does Claude watermark its text?

Claude does watermark its text, and Anthropic confirmed it publicly in August 2026. Its support documentation states that Claude embeds "an imperceptible watermark directly into the text itself", one that leaves the meaning, quality and readability of the response unchanged. The marking applies to Claude models launched on or after 2 August 2026, across the API, Claude, Claude Code, Cowork and Claude Tag, including deployments on AWS, Google Cloud and Microsoft Foundry. Anthropic presents it as a transparency commitment under Article 50(2) of the EU AI Act. Separately, Claude attaches signed C2PA provenance metadata to image files it generates, which behaves nothing like the text mark.

How does the Claude watermark work?

The Claude watermark works by biasing which words the model picks. At each step of writing a sentence, a language model holds several near-equivalent candidates for the next word. Published watermarking approaches nudge that choice according to a secret key, so the output stays natural while the pattern of choices carries a signal. Spread across a whole passage, that pattern becomes detectable by anyone holding the key.

Anthropic has not published its specific scheme, so treat the mechanism above as inference from published approaches rather than a disclosed specification. Alex Cui, CTO of GPTZero, described the technique as subtly changing "the probability of which words a model selects". The practical consequence is the same either way: a find-and-replace has nothing to find, and that also decides whether Claude Code output carries the mark.

Does Claude Code watermark its output?

Claude Code output carries the mark, because Anthropic lists Claude Code among the covered surfaces alongside the API, Claude, Cowork and Claude Tag. The marking attaches to text the model generates, and it does not distinguish prose from anything else the model writes.

For developers that raises a question the writing case does not. Committed code, commit messages, pull request descriptions and documentation all pass through the same generation path. Anthropic has published no guidance on how the scheme treats source code specifically, and we have not tested it, so this is the honest limit of what is known rather than a claim in either direction. What is known is the surface list, and Claude Code is on it. The regulation behind that list explains why the list exists at all.

Does the EU AI Act require this?

The EU AI Act is the stated reason the marking exists. Anthropic presents it as a transparency commitment under Article 50(2), which obliges providers of generative AI systems to mark synthetic output in a machine-readable way so it can be identified as artificially generated.

Two consequences follow that people miss. The obligation sits with the provider, not with you, so removing invisible characters from your own copy breaks no rule in the Act. And the Act carves out content where AI performed "an assistive function for standard editing" without substantially altering it, which is a legal distinction the watermark itself cannot make. That gap between what the law exempts and what the mark can detect is the sharpest practical problem in the whole scheme.

Which marks are fragile and which are durable?

The two marks fail in opposite directions. C2PA manifests are tamper-evident but shed easily: re-saving, converting format, screenshotting or uploading to a platform that reprocesses images usually drops them, so a missing manifest proves nothing. The text mark is the durable one, which is what makes the removal question worth answering honestly.

Can any tool remove Claude's watermark?

No character-level tool can remove Claude's watermark, including this one. The signal is distributed across the word choices themselves, so deleting invisible characters leaves it entirely intact. Reporting on comparable systems indicates the mark degrades under heavy paraphrasing, translation or full rewriting, because those replace the word choices it rides on. Cui told City AM that free paraphrasers had quickly bypassed Google DeepMind's SynthID. We report that because it is published and directly relevant. This site does not provide a paraphraser and does not recommend one.

Two further limits cut against reading too much into any result. Short passages may not carry enough text to score reliably, so both false positives and false negatives are live possibilities. And Anthropic itself frames a detected mark as "a signal rather than conclusive evidence", which is a weaker claim than the phrase "AI detection" usually implies.

There is a trade in the tools that do claim it. Rewriting your text requires sending it to a server, because the rewrite is done by another language model. At least one competing Claude tool routes submissions through a third-party inference provider and retains abuse-prevention signals for thirty days. That is a reasonable engineering choice and it is the opposite of a private one.

This tool cannot rewrite anything, and that limitation is the same fact as its privacy guarantee: character cleaning is arithmetic on a string, so it runs in your browser and the text never leaves your device. You are choosing between a tool that might degrade a signal and has to read your text, and one that cannot degrade it and never sees it. Neither choice touches the invisible characters, which is what this tool actually removes.

What if you only used Claude to edit your own writing?

Text you wrote yourself can still carry the mark if Claude touched it. Because the watermark is applied to text the model produces, asking Claude to proofread, translate or restructure your own draft can return copy that carries it. The EU AI Act exempts content where AI performed "an assistive function for standard editing" without substantially altering it, but that is a legal distinction, not something the watermark can detect. A detected mark is not evidence that a human did not write the underlying work. This is the least discussed consequence of the whole scheme, and it lands hardest on people who use AI as an editor rather than as a writer, which is also the group most likely to reach for a remover.

What does this watermark remover actually remove?

This remover strips 90+ invisible and ambiguous Unicode code points, which is roughly twenty times what a typical zero-width cleaner covers. Most tools in this category delete four or five characters and stop. This one checks every character in your text against the full set that is invisible, ambiguous, or usable as a fingerprint, then reports each one by code point and count.

What does decoding a hidden message mean?

Decoding a hidden message means reading the data those invisible characters encode. Unicode tag characters and variation selectors map onto ordinary bytes, so a run of them sitting after a normal word is not noise, it is a payload. When this tool finds such a run it reconstructs the message and shows it to you. That distinction matters: scattered single characters look like passive marking, whereas a decodable payload means something was deliberately embedded. Free tools in this category typically hand back a count and stop, which is also why the characters are worth understanding beyond the watermark question.

Why do hidden characters matter beyond AI detection?

Hidden characters matter because they break systems quietly. Invisible Unicode corrupts CSV imports, fails string comparisons, breaks URL slugs, throws off word counts, produces mystery bugs when pasted into code, and gets flagged by some CMS and ATS parsers. Stripping it is basic text hygiene, entirely separate from any watermark question.

It also travels. Copy a paragraph out of a chat window into an email, a document, a pull request or a job application, and the hidden characters go with it, because they are real characters rather than formatting. Anyone wanting to fingerprint one specific copy of a document would do it exactly this way, crudely but effectively, and this tool will show you if they did. Those are the practical questions people ask most often.

Common questions