AI Text Watermark RemovalClaude Statistical Watermark
How Claude’s text watermark actually works, why no character-removal tool can touch it, and what can be done to dilute the mark. Honest limits, no false promises.
How does Claude's statistical watermark work?
Claude's statistical watermark biases token sampling during generation, so the choice between equally valid words carries a detectable signal across a long enough passage. Nothing is inserted into the text, which is why no character-removal tool can reach it.
- The mark is in word choice, not in hidden characters.
- It needs a reasonable length of text to be detectable at all.
- Editing, paraphrasing and restructuring dilute it; deleting codepoints does not.
- Detection is probabilistic, not a cryptographic proof.
The mechanism
A language model generates text one token at a time. At each step, it assigns probabilities to candidate tokens and samples one. Claude’s watermark replaces the randomness in that sampling with a deterministic function: a keyed hash of the tokens generated so far. The hash selects from among candidates that are near-equivalent in probability.
The result is text that is statistically indistinguishable from unmarked output to a human reader, but carries a detectable pattern for anyone holding the key. The mark lives in which words were chosen, not in anything inserted between them.
Why character removal cannot work
The watermark does not insert any special characters. There is no zero-width space to delete, no tag character to strip, no variation selector to remove. The marked text and the unmarked text can be byte-for-byte identical in terms of which codepoints they contain. The difference is purely in the statistical distribution of those codepoints.
This is why scanning Claude output for invisible characters typically finds nothing — and why that finding tells you nothing about whether the text is watermarked.
What actually dilutes the mark
Anthropic’s own documentation states that the mark may not be detectable when the text has been:
- Heavily edited or paraphrased
- Translated to another language and back
- Mixed substantially with other writing
- Very short (too little text for a reliable signal)
The common thread: all of these operations change the underlying word choices, which is what the watermark signal is embedded in.
What about copy-paste artifacts?
While the raw model output contains no invisible characters, the web interface can introduce them during rendering and copy-paste. Non-breaking spaces, zero-width characters for line-break control, and direction marks from the HTML layer can all land in your clipboard. These are not the watermark, but they are worth cleaning — and the Claude tab does exactly that.
Files vs text
Files (images, documents) carry signed provenance metadata — C2PA Content Credentials — which is a cryptographic record attached to the file itself. This is separate from the text watermark and can be stripped by the Files tab. Text pasted into a box has no file to carry metadata, so C2PA never applies to it.
What no tool can currently do
- Verify removal. No public detector exists. Nobody outside Anthropic can confirm whether a given edit removed the statistical mark.
- Guarantee undetectability. Even after rewriting, there is no way for a user to verify the result.
- Detect the mark without the key. The watermark is designed to be detectable only by the key holder.
Frequently asked questions
How does Claude's statistical watermark work?
At each generation step, a language model chooses among several near-equivalent candidate tokens. Claude's watermark replaces the usual randomness in that choice with a keyed hash of the words written so far. The output distribution stays the same, the words stay natural, and the mark lives in the pattern of which candidates were selected across a passage.
How do you remove the statistical watermark?
By changing the word choices. Our rewriting engine swaps synonyms, restructures sentences, and varies phrasing to break the statistical pattern. Three intensity levels (Light, Medium, Aggressive) control how many words are changed. The more words changed, the more the watermark signal is diluted.
What intensity should I use?
Start with Medium (~35% words changed) for strong watermark removal while maintaining readability. Use Light (~15%) for subtle dilution that preserves more of the original voice. Use Aggressive (~60%) for maximum watermark removal when readability is less critical than removal.
Does the watermark affect text quality?
No. The watermark is designed to be imperceptible. The output distribution stays the same and the words stay natural. The mark is detectable only by someone with Anthropic's secret key.
When was Claude's watermark applied?
Anthropic states that the marking applies to models launched on or after August 2, 2026, and that it is being added to earlier models. It covers output across the API, Claude, Claude Code, Claude Cowork and Claude Tag, worldwide.
What is the difference between the watermark and invisible characters?
The watermark is a statistical bias in word selection. It involves no special characters. Invisible characters (zero-width spaces, etc.) are sometimes introduced by the web interface during copy-paste. Our tool handles both: the Claude tab rewrites text to remove the statistical watermark, while the Text tab strips invisible characters.
Related
Clean the character layer
While the statistical mark cannot be removed by character tools, the paste-artifact invisible characters can. Use the Claude tab to clean them.
Open the Claude tab