Does Anthropic really watermark Claude's text?

Yes, since 11 August 2026. Every Claude model launched on or after 2 August 2026 embeds an imperceptible mark in generated text, applied at the model level so it is present on every Claude surface, and applied worldwide rather than only in the EU. The driver is EU AI Act Article 50, which became enforceable on 2 August 2026. Anthropic states the mark travels through copy-paste and may persist through some editing.

Can the watermark actually be removed?

Anthropic's own documentation says the mark may not survive heavy editing, paraphrasing, translation, mixing with other content, or very short passages. Paraphrasing is on that list, and the rewrite here is a paraphrase pass. But Anthropic has not published its detection mechanism, so nobody outside Anthropic - including us - can currently verify whether a mark is present or gone. We will not claim a result we cannot demonstrate. When a detector is published we will test against it and publish what we find.

What does a detected mark actually prove?

Less than people assume. Anthropic states a mark indicates content may have been processed by Claude - not that Claude authored it. Text you wrote yourself and asked Claude to proofread carries the same mark as text Claude drafted from scratch. The mark cannot distinguish those two cases.

What are the two layers you clean?

Character-level and statistical. The character layer is zero-width codepoints, Unicode tag characters, variation selectors, exotic spacing and typographic punctuation - removed by exact codepoint matching, verifiable by re-scanning, no model involved. The statistical layer is the vocabulary and cadence patterns, plus whatever the watermark contributes; that can only be addressed by rewriting.

Can invisible characters really be hidden in text?

Yes, and they survive ordinary copy-paste. Zero-width characters, Unicode tag characters and variation selectors all render as nothing while remaining fully present in the data. Run the free scan on any text and you will see the exact count.

Does the rewrite change my meaning?

It is instructed not to. Facts, figures, names, dates, quotations, citations, URLs, paragraph structure and claim strength are all held fixed, and any sentence without a marker is returned verbatim. Read the result before you use it — that is true of any tool that touches your writing.

Will this defeat a specific AI detector?

We make no claim about any named detector, and no claim to verified watermark removal. Detectors are proprietary, they change without notice, and they disagree with each other. Anthropic's watermark has no public detector at all yet. What we state precisely: the character-level markers are removed exactly and verifiably, and the wording markers in your scan report are what the rewrite targets.

Why is the scan free?

Because it costs us almost nothing. It is exact character matching, not a model call, so there is no reason to charge for it. You only spend words when you ask for an actual rewrite.

What happens to my text?

It is processed to produce your result and saved to your history so you can retrieve it later. You can delete any entry. It is never used to train a model.

How is usage counted?

By word, against the input text. Scans are free and never counted. Each plan also caps the words in a single request, so long documents need a higher tier or splitting up.

Can I use this on text I wrote myself?

Yes, and plenty of people do. Human writing picks up invisible characters from PDFs, CMS editors and word processors, and the typographic punctuation cleanup is useful on its own. The scan will tell you whether there is anything there.

Is removing Claude's watermark allowed?

What the EU AI Act actually requires of users versus providers, what institutional rules cover, and where the real risk sits.

Removing the watermark · 3 min read

Three separate questions get collapsed into this one. They have different answers.

1. Does the EU AI Act prohibit it?

Article 50 places its marking obligation on providers of generative AI systems — whoever supplies the model. Anthropic satisfies it by marking Claude's output. The article does not make editing that output an offence for the person who received it.

It also does not require the mark to survive editing. It requires marking; it sets no durability threshold. Anthropic's own documentation says the mark may not survive heavy editing, paraphrasing or translation — which would be a strange thing to publish if surviving editing were a legal requirement.

So: the regulation is not aimed at you, and normal editing of text you received is not what it regulates.

2. Does it breach Anthropic's terms?

Read them for your own situation rather than trusting a summary. But the ordinary use of a writing tool — receiving output and editing it — is what the product is for. There is a meaningful difference between editing text you were given and, say, building a service to strip provenance from material you intend to pass off as someone else's work.

3. Does it satisfy your institution?

This is the one that actually matters, and no tool touches it.

If your university, employer, journal or platform requires you to disclose AI assistance, that requirement is about what you did, not about what is detectable in the file. Removing a mark does not change the history. A disclosure rule is not satisfied by making non-disclosure harder to catch.

That is worth stating plainly because it is the actual risk. The legal exposure of editing text is negligible; the academic or professional exposure of undisclosed use is not, and it does not depend on any watermark existing.

Where legitimate use sits

Plenty of people have reasons to clean text that have nothing to do with concealment:

Publishing workflows. Claude output is full of em dashes, curly quotes and single-codepoint ellipses. If your CMS or house style wants ASCII, you normalise it — same as you would with text from Word.
Documents from third parties. If you are handed a file to publish, knowing what invisible characters are in it is basic diligence. Tag characters have been used as a prompt-injection vector.
Your own writing that Claude proofread. You wrote it. The mark says "may have been processed by Claude", which is true and says nothing about authorship — but it is also indistinguishable from Claude having written it, which is a reason people want it gone.
Privacy from per-recipient tracking. Hidden characters can distinguish copies of a document. Not wanting that is not suspicious.

What we will and will not tell you

We will not tell you removal is verified. Anthropic has not published a detector, so nobody can confirm a mark is present or gone.

We will tell you exactly what the character-level pass removed, with counts you can re-verify yourself, and that the rewriting pass is a paraphrase — the mechanism Anthropic itself names as degrading the mark.

And we will say clearly that if you have a disclosure obligation, this tool does not discharge it. That is between you and whoever set the rule.

Is removing Claude's watermark allowed?

1. Does the EU AI Act prohibit it?

2. Does it breach Anthropic's terms?

3. Does it satisfy your institution?

Where legitimate use sits

What we will and will not tell you

Related

Does Claude's API output carry the watermark?

How to check if text has Claude's watermark

Claude's watermark and Turnitin: what schools can actually see