Removing the Claude watermark: what works and what doesn’t

Since 2 August 2026, every Claude model embeds an invisible watermark in the text it generates. The EU AI Act requires it, and Anthropic applies it worldwide. This page explains what the watermark really is, what removes it and what doesn’t, because some tools sell as a fix something that never touches the watermark.

What the Claude watermark is

It isn’t a hidden character or a tag you can delete. It’s a statistical mark: it lives in the way the model picks some words over others, an imperceptible bias spread across the text. That’s why you can’t see it when reading, why it leaves the meaning intact, and why, according to Anthropic itself, it survives copy and paste and some light editing.

This is what makes “removing the Claude watermark” different from stripping metadata. There’s nothing visible to cross out: the signal is in the choice of words, so the only way to undo it is to change those words.

How the watermark works, according to Anthropic

Anthropic has described the mechanism publicly, and it’s worth understanding because it explains what works and what doesn’t. When the model has several equally good words to continue a sentence, it doesn’t pick at random: it picks with a secret key, based on the last few words of context. Anthropic compares it to playing a board game with the digits of π instead of a die: the rolls look normal to anyone, but whoever knows π was used can look at the finished game and prove there was no die.

• Only the key holder can detect it. Without the key, the signal is indistinguishable from chance. That’s why no outside detector, this tool included, can tell you whether the watermark is still there.
• It only marks where there’s a choice. In code, figures or exact data, where a different word would be an error, it isn’t applied. That’s why prose carries the most watermark.
• It needs length. According to the published figures, the detector is right about 70% of the time at 200 words and 87% at 400, accepting a 1% false-positive rate; at 50 words it barely works.
• It detects contact, not authorship. A positive says the text passed through Claude, not that Claude wrote it. An uncomfortable figure Anthropic acknowledges: in a study of essays written by people, a spelling-and-grammar-only AI pass raised the detection rate from 4% to 25.5%. A few words are enough.

The practical consequence is simple. Since the mark lives in word choice within short windows of context, what degrades it is that no literal sequences of the original survive. Swapping isolated synonyms while leaving the sentence intact isn’t enough; the order, the breaks and the connectors have to move.

What actually removes it

Anthropic says it in its own announcement: the watermark becomes undetectable with heavy editing, paraphrasing, translation, or mixing Claude’s text with your own writing. It all points the same way: a deep rewrite. The further the final text moves from the exact words the model chose, the less of the statistical signal remains.

• Rewrite the whole text, beyond touching up four sentences. Half a rewrite leaves half a watermark.
• Change the order and the rhythm along with the synonyms. The signal is in the pattern, spread across the words.
• Mix in your own writing. Every paragraph you write from scratch is a paragraph with no watermark.

What does NOT remove it (whatever they tell you)

Some tools promise to remove the Claude watermark by cleaning out “zero-width characters” and other invisible symbols. That’s text hygiene, useful and also done here, but it leaves the Claude watermark untouched: Claude’s mark is statistical, and there’s no hidden character to delete. Anyone who tells you that deleting invisibles removed the watermark is selling you one thing as another.

And nobody, us included, can guarantee the watermark is gone, for a simple reason: only Anthropic has the detector. From the outside there’s no way to measure whether any signal remains. Anyone promising a “100% clean and verified” result is promising something they can’t check.

What this tool does

Four concrete, checkable things:

• It rewrites the text deeply, with a different model. The model is told that almost no five-word sequence of the original may survive: reorder clauses, move sentence boundaries, change connectors and function words, while names, figures, quotes and web addresses stay as they are. And Claude doesn’t do the rewrite: asking the same model to remove its own mark means asking it to put it back. A model from another company rewrites it, one that carries no Anthropic watermark.
• It shows you how much of the original is left, and what changed. When it finishes, a report calculated in your browser shows what share of your text’s five-word sequences has disappeared, along with the change in rhythm and the filler phrases that remain; the text comes back with every change underlined and a note in the margin explaining why. It’s the measure that matches how the watermark works (a detector exists only at Anthropic) and you can check it by counting. See it in action on the AI humanizer page.
• It offers variations. If the first rewrite leaves you cold, or the report says the rhythm went flat, you ask for another and the model takes a different route, seeing the previous one.
• It cleans invisible characters along the way: zero-width spaces, soft hyphens and other stowaways that dirty the text. They’re counted before and after. It’s hygiene, separate from the watermark, and it’s called by its name.

To be straightforward about it: a deep rewrite with another model is the best bet against the watermark, and the report tells you how much was rewritten. What nobody can tell you, because nobody outside Anthropic can know, is whether the detector would come back negative. This is a measurable rewrite, sold as exactly that.

Frequently asked questions

Does Claude really watermark all its text?

Yes. Anthropic announced it in August 2026: every model released since 2 August marks the text it generates, in the API, on claude.ai, in Claude Code and in the models served through AWS, Google Cloud and Microsoft. It’s there to comply with Article 50 of the EU AI Act, and it applies worldwide, beyond Europe.

Does rewriting the text remove the watermark completely?

A deep rewrite makes it undetectable, as Anthropic describes it, but “completely” is a word nobody outside can stand behind, because only Anthropic has the detector. The honest version is that the further the text moves from the original words, the less signal remains.

Does cleaning invisible characters remove the watermark?

Not Claude’s watermark, which is statistical. It does give you a clean text: invisible characters break word counts and searches, so they’re worth removing anyway. They’re two different problems, and here each is handled separately and by name.

What if the text is mine and only went through Claude for polishing?

Then the watermark is only in the parts the model wrote, but remember the figure above: a spelling-and-grammar-only pass multiplied the detection rate in human essays by six. Rewriting those passages in your own words, or keeping yours and redoing only the model’s, cleans the signal best, and the text sounds like you again.

Why does the report count five-word sequences?

Because the watermark is decided, word by word, from the few words before it. If a short sequence of the original survives literally, it survives with its marked choice; if it disappears, the choice goes with it. Counting what share of those sequences is gone is the most honest way to measure how much was rewritten, without claiming to know what the detector would say.