Claude Text Watermark: How It Works, Detection, and Limits

In August 2026, Anthropic published 'How Claude marks AI-generated content' on its official help center, confirming something that was previously only a rumor: Starting from August 2, 2026, Claude models released will embed invisible watermarks at the model level in generated text, and attach digital signature traceability metadata to generated images and other files. The policy is effective globally, covers all Claude product lines, and users have no off switch.

The announcement sparked much controversy, but much online discussion was based on a wrong assumption—that the watermark involves stuffing hidden characters into the text. Based on official documentation and public technical analysis, this article clarifies the mechanism, boundaries, and common misconceptions point by point.

What did the official confirm?

Anthropic signed the EU Artificial Intelligence Act Article 50(2) 'AI-Generated Content Transparency Code of Practice,' which is the direct legal background for the watermark policy. The commitment scope given in the official documentation:

• Models: Claude models released on or after August 2, 2026, will support marking at launch; earlier legacy models will gradually add support later.
• Products: Covers Claude Platform (API), Claude App, Claude Code, Claude Cowork, Claude Tag—all generated text will have embedded watermarks.
• Cloud platforms: When calling supported Claude models through AWS, Google Cloud, Microsoft Foundry, text watermarks also apply.
• Regions: Although the motivation is EU regulations, the marking applies globally, regardless of region.

Two mechanisms complement each other:

1. Text embedded watermark: When generating text, it is directly 'woven into' the text itself, invisible to the naked eye. The official claims it does not change semantics, quality, or readability. Since the watermark is part of the text, copy-pasting will carry it along, and it may still remain after some editing.
2. File signature metadata: When generating supported file types like .svg, .png, .jpg, it attaches signature metadata following the C2PA (Coalition for Content Provenance and Authenticity) open standard, which is the same industry standard used by Google and Adobe.

Principle: Not zero-width characters, but a fingerprint in the probability distribution

Many people, when hearing 'invisible text watermark,' first think of zero-width spaces (U+200B), variation selectors, and other hidden Unicode characters. This is not the solution Claude uses—hidden characters are clearly visible in a hex editor, and a find-and-replace can clear them out, making them worthless as a traceability mechanism.

The original help center documentation did not disclose the specific algorithm, but multiple media and technical analyses pointed to the same type of technology: sampling watermark (token sampling watermark), similar to SynthID-Text published by Google DeepMind in Nature in 2024, with the idea traceable to Scott Aaronson's proposal in 2022. On August 16, 2026, Anthropic officially confirmed this mechanism in "How Claude's Text Watermark Works" (see the update section below). The working mechanism is roughly:

• When the model generates each word, it originally samples from a set of candidate words based on probability.
• The watermark algorithm applies a slight probability bias to some candidate words according to some hidden rule.
• Looking at a single sentence, it is no different from normal output; but when the text is long enough, this statistical preference forms a pattern that can be recognized by a dedicated detector.

It can be understood as a fingerprint hidden in the text's probability distribution, not a secret code hidden in characters. This explains two things: why copy-pasting doesn't remove it (the fingerprint is the word selection itself), and why the 'AI watermark removal tools' circulating online (those that delete zero-width characters, replace curly quotes, etc.) are completely ineffective against it—they target a different mechanism that doesn't exist in Claude's output.

According to Forbes, an Anthropic engineer added three details on social media: the detection API will be open for users to call later; the model itself doesn't know it has been watermarked; and a candid evaluation—"it's not perfect, you can remove it through editing, but this is a first step."

Update (2026-08-16): Anthropic publishes the technical details — and the controversy escalates

When this article was first published, the section above was "informed speculation." Now there's an official answer. On August 16, Anthropic published the technical explainer How Claude's Text Watermark Works. Key points:

• It is confirmed to be a statistical watermark: at each token, candidate words are dynamically split into "green" and "red" groups using a secret key, with a slight probability bias toward the green group. Nothing is added to the text and there are no hidden characters—the same word can be green at one decision point and red at the next, so there is no fixed list of "words Claude prefers."
• Only Anthropic, holding the key, can detect it, and watermarks are not interoperable across vendors: Claude cannot detect Gemini's SynthID marks, and vice versa.
• It applies to text longer than roughly 200 tokens (~150 words)—which is also the threshold in the EU's Code of Practice on Transparency of AI-Generated Content. The same Code requires providers to forbid watermark removal in their terms of service, and demands robustness against "typical processing" like copy-paste, screenshots, OCR, and translation.

The day after the explainer went out, John Gruber published Anthropic's 'Watermark' Text Adulteration in Claude Is a Perversion of Writing on Daring Fireball, pushing the controversy into the spotlight. His core objection is not privacy but writing quality: unlike image metadata, a text watermark alters the very thing that matters—which word gets chosen. No two synonyms are exactly equivalent; "leaped at the chance" and "jumped at the opportunity" are not the same sentence. Once you know a green/red word list is in play, every word choice becomes suspect: did the model pick this word because it fit best, or because it was in the green group? Gruber also points out a gap between the official "imperceptible, no impact on quality" claims and what SynthID's own Nature paper actually showed—the paper only demonstrated that human preference differences were "statistically insignificant," which is not the same as imperceptible.

A second line of criticism comes from James Padolsey (whose interactive explainer is the best introduction to how these watermarks work): this kind of watermark is hardest on honest users and weakest against bad actors—ordinary assistive use like polishing your own writing gets marked, while anyone deliberately passing AI text off as their own can wash out the statistical signal with a single pass through a non-compliant paraphrasing model. His own Declaude is a ready-made example: paste text in, get rewritten "plain prose" out, watermark gone. This matches the original conclusion of this article: it's a weak signal, not a verdict.

The practical takeaways haven't changed—if anything, they're now clearer:

1. Stop using "scan for hidden characters" as a defense against Claude's watermark—Anthropic has now explicitly confirmed there are none. If what you want to check is whether a text contains zero-width characters or variation selectors (a different kind of steganography that other tools and malicious injections still use), run it through our AI Watermark Checker for a definitive answer.
2. For file provenance, look at C2PA: images and other files generated by Claude carry C2PA-signed metadata, and this part you can verify yourself—drop the file into our C2PA Content Credentials Verifier, which validates signatures locally in your browser without uploading the file.
3. The text watermark itself remains undetectable and unremovable by third parties—the official explainer actually confirms this: no key, no detection.

Can it be detected now?

As of the publication of this article, there is no publicly available official detector. The official documentation states that it is 'supporting users and third parties in detecting Claude's marking,' and details of the detection mechanism will be published in subsequent technical documentation.

This means that any tool claiming to 'detect Claude watermarks' in the current market is suspect: general 'AI content detectors' do writing style classification, which is different from watermark detection—the former has a known false positive rate for human authors, while the latter requires secret keys or algorithm details that Anthropic has not yet disclosed.

Boundaries acknowledged by the official themselves

It is commendable that Anthropic proactively wrote out the limitations of the detection conclusions in the documentation. These two points are important for anyone wanting to use 'watermark detection' as a judgment tool:

Detected watermark ≠ Claude is the author. Many users use Claude for proofreading, translation, summarization, and file format conversion—the output will carry the watermark, but the underlying ideas, text, and data are entirely from humans. If you use Claude to polish a paragraph you wrote, the output is your own ideas with a mark.

No detected watermark ≠ Not AI-written. The official lists failure scenarios including:

• Generated by models released before August 2, 2026
• Text is heavily edited, rewritten, translated, or mixed with other text
• Paragraphs are too short to carry reliable statistical signals
• File metadata is stripped during format conversion, resaving, or screenshots
• Produced through platforms or file types that do not yet support marking

In other words, the watermark is a one-way weak signal: detection indicates 'possibly processed by Claude,' but lack of detection proves nothing. Any use of it as a 'final AI judgment'—such as schools or employers drawing conclusions directly from detection results—exceeds the design capability of the mechanism itself, which is the most concentrated point of this controversy.

Impact on practical use

For ordinary users and developers, a few things are worth knowing:

• Cannot be turned off. The watermark is injected at the model level, regardless of product entry, and API calls also carry the mark.
• Code comments, documentation, and commit messages written by Claude Code are also covered—the official stance is 'all generated text.' As for how much statistical signal the code itself can carry (identifiers and syntax are highly constrained), the official has not specifically stated.
• Quality trade-offs are real. The official claims the watermark does not affect output quality; academic research has documented a general trade-off between watermark strength and text quality—watermarks that are more resistant to editing are more likely to disturb output. As for where Claude's implementation is tuned to, it cannot be externally verified for now.
• If your product is built on the Claude API, EU AI Act Article 50 may impose independent transparency obligations on your product. The official recommends self-assessment, and supporting technical guidelines will be released later.

Frequently Asked Questions FAQ

Can Claude's text watermark be turned off?

No. The watermark is fully injected at the model level, covering all product lines and cloud platform entries, and the official has not provided any opt-out option. This is part of Anthropic's compliance with the EU AI Act Article 50(2) transparency commitment, and it is effective globally.

Can copy-pasting or converting to other formats remove the text watermark?

No. The watermark is hidden in the statistical distribution of word choices, not in hidden characters. Copy-pasting, changing fonts, or converting formats will not remove it. The official acknowledges that heavy editing, rewriting, and translation may destroy the signal, but there is no reliable 'removal' method—and the 'watermark removal tools' on the market that delete zero-width characters target a different mechanism and are ineffective against Claude's watermark.

Are there tools now to detect if a text was written by Claude?

Not yet. Anthropic's August 16 technical explainer confirms that the watermark relies on key-based green/red word-list probability bias, so only Anthropic can detect it, and the detection API has not been opened up. Existing third-party 'AI detectors' do writing style judgment, not watermark verification, with high false positive rates, and the results cannot be used as a basis. If what you want to check is whether a text contains zero-width characters or other hidden characters (a different kind of steganography, unrelated to Claude's watermark), you can scan it locally with our AI Watermark Checker.

Does content generated by old Claude models carry watermarks?

Models released before August 2, 2026, do not currently carry marks. Anthropic states that it is adding marking support for legacy models and will update the official documentation.

If I use Claude to modify an article I wrote myself, will the result be marked as AI-generated?

It will carry the watermark—which is exactly the boundary clearly indicated by the official: the watermark only indicates that the content 'has been processed by Claude,' not that Claude is the author. If an institution uses watermark detection results to directly determine 'this is AI-written,' it is a misuse of the mechanism.

Reference Links

• How Claude marks AI-generated content — Anthropic Official Help Center
• How Claude's Text Watermark Works — Anthropic official explainer (2026-08-16)
• Anthropic's 'Watermark' Text Adulteration in Claude Is a Perversion of Writing — Daring Fireball
• How AI Text Watermarking Works — interactive explainer by James Padolsey
• Anthropic's Weak Watermarks Appease a Weak Law — James Padolsey
• Claude Will Put Invisible Watermarks On AI Text And Images — Forbes
• Claude AI Watermark: How Anthropic Marks AI-Generated Text — Business Standard
• Claude launches invisible watermarks; copied text stays traceable — unwire.hk (Chinese)
• Scalable watermarking for identifying large language model outputs (SynthID-Text) — Nature, 2024
• C2PA Content Provenance and Authenticity Specification