As of August 2026, every block of text Claude generates carries an invisible watermark. You can’t see it, spell-check won’t flag it, and it survives a copy-paste from Claude straight into your doc. Anthropic built it so that AI-written text can be traced back to the model, and the mark rides along quietly inside the words themselves.
If you own the content you generated and want that fingerprint gone, an open-source project called watermarks-remover is the tool most people are reaching for. This guide walks through what Claude’s watermark actually is, what the tool can and can’t strip, and exactly how to run it.
A word before we start: this is about hygiene and privacy on text and files you own. Removing a provenance mark to commit academic fraud, dodge a disclosure policy, or pass AI work off as human under a contract that forbids it is a bad idea and often against the rules that bind you. Know the terms you’re operating under.
TL;DR
- What the mark is: Claude nudges its word choices according to a secret key, leaving a statistical signature spread across a passage. It’s not a hidden character you can find and delete. There’s also a separate, file-level C2PA metadata tag on images and some documents.
- What survives: The statistical text mark survives copy-paste. It degrades under paraphrasing, heavy editing, and translation. It’s weak-to-absent in short passages and in code (formatters wipe out what little signal exists).
- The tool: watermarks-remover is an MIT-licensed, Python-3.10+, standard-library toolkit. It handles two different jobs with two different layers.
- Layer A (deterministic): Strips invisible Unicode, exotic spaces, bidi characters, and tag characters from text. Fast, testable, lossless. This is the reliable part.
- Layer B (statistical): Attacks the token-sampling watermark by rewriting the text. Best-effort only, and rewording degrades your prose.
- Files: Strips C2PA, EXIF, XMP, and document properties from PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown.
- The honest catch: A clean deterministic strip is easy. Fully removing the statistical watermark means rewriting the content, which is exactly the quality trade-off you were trying to avoid.
What Claude’s watermark actually is
Start with the thing most people get wrong. Claude’s text watermark is not a run of hidden characters sitting between your words. There’s no zero-width space to search for, no suspicious glyph to isolate, no odd kerning to measure.
Instead, the mark lives in the words themselves. When Claude generates text, at each step it picks the next token from a set of statistically near-equivalent candidates. The watermark biases that choice according to a secret key. Over a long enough passage, those nudged choices add up to a detectable statistical signature. Read one sentence and you’d never know. Feed a few hundred words to a detector holding the key and the pattern shows up.
That design has two consequences that matter for removal:
- It survives copy-paste. Because the signal is baked into word choice, not metadata, moving the text from one app to another carries the watermark along.
- It’s fragile under editing. Change enough of the words and you break the statistical pattern. Paraphrase, translate, or blend Claude’s output with your own writing and the signal decays.
Anthropic rolled this out at the model level starting August 2, 2026, which means no product surface opts out. Claude apps, the API, Claude Code, and third-party access through AWS, Google Cloud, and Microsoft Foundry all emit the mark. Anthropic has said a detection API is coming so users and third parties can check for it. If you want the background on how Anthropic’s model lineup and access policies have been shifting, we covered a related episode in Fable 5 Is Down for Everyone.
One caveat worth repeating, because it cuts both ways: a positive detection means the text may have passed through Claude, not that anyone cheated. Proofreading, translating, and summarizing all leave the same trace as ghost-writing does.
Two different watermarks, two different fixes
watermarks-remover splits the work into layers because Claude (and other vendors) actually use two unrelated marking systems, and they need completely different treatment.
Layer A, deterministic character stripping. This targets invisible Unicode: zero-width spaces, exotic whitespace, bidirectional-text controls, and Unicode tag characters. Some tools and pipelines embed provenance or tracking data this way. Layer A is pure Python with no model involved, so it’s deterministic, testable, and lossless, it removes junk without touching your actual prose. This is the part that “just works.”
Layer B, statistical rewriting. This is the one aimed at Claude’s token-sampling watermark described above. Because the signal is the word choice, the only way to remove it is to change the words: rewrite the text sentence by sentence. The project is upfront that this is best-effort, not a guarantee, and that rewording flattens style and can blunt precision.
Files, metadata stripping. Separately from text, the tool cleans C2PA manifests, EXIF, XMP, and document properties out of PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown. C2PA is the Coalition for Content Provenance and Authenticity standard, a signed manifest that rides alongside a file. Unlike the statistical text mark, C2PA is trivially strippable: re-save the file, convert the format, or screenshot the image and the manifest is gone.
The tool covers Claude, Gemini/SynthID-Text, OpenAI, and open-source (Kirchenbauer-style) marks with the same architecture. Pixel-domain image watermarks like SynthID are out of scope for removal, though the project can optionally score them via an external reverse-SynthID checkout.
What the watermark misses on its own
Before you run anything, it’s worth knowing where Claude’s mark is already weak. In these cases removal is easy or unnecessary:
- Short passages. A few sentences don’t contain enough token choices to accumulate statistical confidence. The detector needs length.
- Code. Source code has far more constrained token choices than prose, so the signal is faint to begin with. Then formatters, linters, and refactoring tools rewrite whatever entropy remained. By the time your code is committed, there’s often nothing left to detect. This is why the watermark on Claude Code output is more theoretical than practical.
- Heavily edited text. If you already rewrote half of it, you may have broken the pattern without trying.
- C2PA on files. Any format conversion or re-save typically drops it.
Which means the honest scope of a “removal” job is usually: long-form prose you kept mostly as Claude wrote it, plus any file metadata.
Installing watermarks-remover
The project ships as an agent skill plus a set of standalone Python scripts. You need Python 3.10+; the core scripts use only the standard library, so there’s nothing to pip install for the basic text and metadata work.
Clone the repository:
git clone https://github.com/guillaumemeyer/watermarks-remover.git
cd watermarks-remover
If you want to invoke it as an agent skill (the repo’s examples use a Grok-style skills directory), link the skill folder in:
mkdir -p ~/.grok/skills
ln -sfn "$(pwd)/skills/remove-ai-marks" ~/.grok/skills/remove-ai-marks
For everyone else, you’ll call the scripts directly. Set a shortcut to the scripts directory so the commands below read cleanly:
export SCRIPTS="$(pwd)/skills/remove-ai-marks/scripts"
Two optional command-line tools extend the file-cleaning side if you have them installed:
c2patoolfor inspecting C2PA manifests in detail.exiftoolfor mopping up residual image metadata Layer A doesn’t reach.
Neither is required for the core workflow.
Inspecting a file before you touch it
Never strip blind. Run the inspector first so you know what’s actually present, invisible characters, metadata blocks, provenance manifests, before you decide what to remove.
python3 "$SCRIPTS/inspect_file.py" draft.md
This reports what the tool detects without modifying anything. It’s the equivalent of reading the target before you overwrite it: if the inspector shows the file is already clean, you’re done, and if it surfaces something surprising you get to decide before any bytes change.
Removing marks from text
For deterministic Layer A cleaning, the reliable, lossless pass, use clean_text.py. The --stats flag prints a summary of what it found and removed:
python3 "$SCRIPTS/clean_text.py" draft.md -o draft.cleaned.md --stats
This strips invisible Unicode, exotic spaces, bidi controls, and tag characters. It leaves your visible prose untouched, so there’s no quality cost. For most people worried about hidden tracking characters rather than the statistical mark, this single command is the whole job.
The -o flag writes to a new file rather than overwriting the original, keep the source until you’ve verified the result.
Stripping metadata from files
For images and documents, clean_file.py removes C2PA, EXIF, XMP, and embedded document properties:
python3 "$SCRIPTS/clean_file.py" photo.png -o photo.cleaned.png
It handles PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown. If you have exiftool installed and want to be thorough on images, run it afterward to catch any residual tags:
exiftool -all= photo.cleaned.png
Remember that C2PA is the easy case. If your only concern is the provenance manifest on a Claude-generated image, a format round-trip often removes it on its own, this tool just does it cleanly and predictably.
The Layer B problem: rewriting to beat statistics
Here’s where honesty matters more than the command syntax.
The statistical text watermark can only be removed by changing the words. The tool exposes this through rewrite_text.py, which prepares a paraphrase pass:
python3 "$SCRIPTS/rewrite_text.py" draft.md --backend print-prompt --strength paraphrase
The --backend print-prompt option emits the rewriting prompt rather than calling a model directly, so you stay in control of what does the rewriting. --strength controls how aggressive the reword is.
But read what you’re actually agreeing to. To break a signal that’s distributed across word choice, you have to rewrite sentence by sentence. That:
- Flattens style. The specific phrasing that carried the watermark also carried the voice.
- Risks precision. Rewording technical content can quietly change meaning.
- Needs a capable model to do well at which point you’re spending premium tokens to rewrite premium-model output.
The project itself raises the obvious question: if you need a strong model to paraphrase Claude’s text into something watermark-free without wrecking it, is that a cheap workaround or just… more model spend for degraded copy? For most legitimate cases the answer is that Layer B isn’t worth it. If the text is short, or it’s code, the mark is probably already too weak to matter. If it’s long-form prose you care about, the rewrite damages the thing you were trying to keep.
The pragmatic takeaway: run Layer A and the file cleaner routinely; reach for Layer B only when you have a specific, legitimate reason and you accept the quality hit.
Verifying your work
Removal is only as good as your ability to confirm it. Re-run the inspector on the output:
python3 "$SCRIPTS/inspect_file.py" draft.cleaned.md
For C2PA specifically, c2patool gives you a definitive read on whether a manifest remains:
c2patool photo.cleaned.png
For the statistical text mark, honest verification is harder, you don’t hold Anthropic’s key. When Anthropic’s promised detection API ships, that becomes the real test. Until then, treat Layer B results as unconfirmed by definition. If you build any of this into a repeatable pipeline, that verification step is exactly the kind of behavior worth testing like any other API workflow; teams that automate content or model checks often wire them into an API testing tool such as Apidog so a “did the mark come back” check runs the same way every time. For the broader pattern of testing model-backed endpoints, see How to Test AI Agents Over an API.
Legal and ethical guardrails
The tool’s own framing is the right frame: this is for privacy and hygiene on content you own. That covers stripping tracking characters from your own drafts, cleaning metadata off images before you publish them, or removing a provenance tag from writing you consider yours.
It does not cover:
- Academic dishonesty. If your institution requires disclosure or forbids AI-generated submissions, removing the mark to hide that is misconduct regardless of how clean the output looks.
- Contractual violations. Plenty of client agreements and platform terms require AI disclosure. The watermark being invisible doesn’t make the obligation invisible.
- False attribution. Passing AI work off as human where that materially misleads someone is the exact harm provenance marks exist to prevent.
There’s also a practical reason not to over-rely on any of this: detection cuts both ways. A watermark hit doesn’t prove authorship, and its absence doesn’t prove human origin. Building a workflow around defeating a signal that’s already ambiguous is often more effort than the situation warrants. When in doubt, disclose. It’s cheaper than getting caught not disclosing.
If your interest here is less about hiding AI use and more about running models on your own terms, with your own provenance policy and no vendor watermark in the first place, self-hosting is the cleaner answer. We covered the current options in The Best Local LLMs to Run in 2026.
FAQ
Can I just find and delete the watermark characters in Claude’s text? No. Claude’s text watermark isn’t made of hidden characters, it’s a statistical bias in word choice. There’s nothing to search for and delete. (Some other tools do inject invisible characters, and Layer A of watermarks-remover removes those. But that’s a different mechanism from Claude’s statistical mark.)
Does copy-pasting Claude’s output remove the watermark? No. The statistical mark is embedded in the words, so it survives copy-paste between apps. Only editing the actual text degrades it.
Is watermarks-remover free? Yes. It’s open source under the MIT license. The core text and metadata scripts need only Python 3.10+ and the standard library.
Will it work on Claude Code output? It’ll run, but the watermark is usually already too weak to matter in code. Source code has constrained token choices, and formatters and linters erase most of the remaining signal. There’s typically little to remove.
Does it remove image watermarks like SynthID? Not the pixel-domain kind. It strips file-level metadata (C2PA, EXIF, XMP) cleanly, and it can optionally score SynthID marks via an external reverse-SynthID setup, but removing an in-pixel watermark is out of scope.
Is removing the watermark legal? Removing a provenance mark from content you own isn’t inherently illegal, but it can violate academic policies, contracts, or platform terms that require AI disclosure. The tool is intended for privacy on your own content, not for evading those obligations.
How do I know the statistical mark is actually gone? Right now you largely can’t verify it yourself, because you don’t hold the detection key. Anthropic has said a detection API is coming, which will be the real test. Layer A character removal and C2PA stripping, by contrast, are easy to verify with the inspector and c2patool.
