How to Detect Claude's Watermark (and Why a Clean Result Proves Nothing)

Anthropic now embeds a machine-readable mark in Claude’s output. The obvious next question is how you check for it. The honest answer, as of August 2026, is that Anthropic has committed to supporting detection but has not published the tooling yet. Its help center says technical documentation is coming.

Try Apidog today

That gap matters because demand for a Claude detector already exists, while the current supply is third-party classifiers that guess. Those are completely different mechanisms, and confusing them can lead to false accusations based on text someone wrote themselves.

This article covers what detection means for Claude’s two marking techniques, what you can verify today, and how to design provenance checks safely. If you are wiring provenance checks into an API, Apidog can turn those checks into assertions that run on every build.

Two marks, two detection stories

Claude marks content in two ways, and they behave very differently.

	Embedded text watermark	Signed C2PA metadata
What it is	A statistical signal woven into generated text	A cryptographically signed manifest attached to a file
Applies to	All generated text	Supported file types: .svg, .png, .jpg
Survives copy-paste	Yes	No; the file is the container
Survives re-encoding	Yes; text is text	No; it is usually stripped
Detectable today	Not publicly; detection support is promised	Yes, with standard C2PA tooling
Tells you	Content may have been processed by Claude	A file was processed by Claude, and whether it was tampered with

The text watermark is durable but cannot currently be read by the public. The C2PA manifest is fragile but can be verified today with off-the-shelf tools.

What you can check today: C2PA manifests

If Claude produced an image or SVG and no downstream step rewrote the bytes, the C2PA manifest remains in the file.

Verify in a browser

Upload the file to the Content Credentials verification page. It reads the manifest and reports:

• The signer
• The claim
• Whether the signature validates

Verify from the command line

Use c2patool, the reference CLI from the C2PA project:

# Read the manifest summary
c2patool report.png

# Show full JUMBF-level detail for pipeline debugging
c2patool report.png -d

A file with an intact manifest returns JSON describing the claim generator, assertions, and signature status.

Interpret the result carefully:

• Manifest present and valid: provenance is verified.
• No manifest found: metadata may have been stripped, or the file may never have had provenance metadata.
• Manifest present but validation fails: the file was altered without re-signing, or its provenance is otherwise broken.

That middle distinction matters: “no provenance found” and “provenance failed validation” are not the same outcome.

Verify from application code

The c2pa libraries expose similar verification capabilities for Rust, Python, JavaScript, and C. Run verification in a request handler, upload pipeline, or automated test.

For example, a service can:

1. Receive an uploaded image.
2. Save the original bytes without recompressing them.
3. Run C2PA verification.
4. Store the verification result with the asset.
5. Return provenance as structured metadata to API consumers.

This is the approach behind building an AI image detector API with C2PA and a classifier, where a manifest provides a confident result when present and a classifier is used separately when it is not.

What you can’t check today: the text watermark

There is no public reader for Claude’s embedded text watermark.

Anthropic has said it will support users and third parties in detecting its marks, as required by the Code of Practice, and that details are coming in future technical documentation. Until that tooling ships:

• No tool can authoritatively tell you whether a passage carries Claude’s mark.
• Any product claiming to detect “Claude-generated text” today is running a classifier, not reading Anthropic’s official signal.
• Classifiers have documented false-positive rates and can misfire, especially on non-native English writing and formal or structured prose.

Treat this as not yet, not never.

When Anthropic publishes a detection mechanism, the practical implementation pattern is a server-side verification step, similar to C2PA validation. Store the result as a signal, not as a final authorship verdict.

For contrast, Google took the opposite approach with SynthID Text: it open-sourced the implementation with a reference detector, so third parties can run it without requesting access. The difference is covered in Claude vs ChatGPT vs Gemini watermarking.

The reasoning error that breaks detection workflows

Detection produces asymmetric results. Many implementations treat those results symmetrically, which is unsafe.

A detected mark is weak positive evidence

A detected mark says content may have been processed by Claude. It does not establish authorship.

People use Claude to:

• Proofread
• Translate
• Summarize
• Reformat
• Convert existing work into another structure

For example, a researcher can write a 3,000-word draft independently, send it to Claude for grammar corrections, and receive marked output. The ideas, reporting, and source material may still be entirely human-authored.

A mark cannot distinguish that workflow from a prompt that says, “Write me 3,000 words.”

Content also changes after Claude touches it. Marked text can be edited, quoted, split across documents, or merged into a larger draft. Finding a mark only indicates that Claude may have processed some portion of the content at some point.

No detected mark is not evidence of anything

Claude-generated content may have no detectable mark when:

• It came from a model released before marking was supported.
• The text was heavily edited, paraphrased, translated, or blended into other writing.
• The excerpt is too short to contain a reliable signal.
• File metadata was stripped by conversion, re-saving, or screenshots.
• The content came through a platform or file type where the marking method is unsupported.

These are normal workflows, not necessarily attempts to evade detection.

The practical rule is:

A positive result narrows possibilities. A negative result proves nothing.

Do not build a policy that punishes people because a detector returned no signal. The same asymmetry has caused problems in image workflows, as covered in why AI image detection fails.

Building detection into a service properly

If you are adding provenance checks to a product, focus less on forcing a binary answer and more on accurately modeling what your service observed.

Return a signal, not a verdict

Avoid unsupported API claims such as:

{
  "ai_generated": true
}

Instead, return the observable verification result:

{
  "provenance": {
    "c2pa": "verified",
    "signer": "...",
    "checked_at": "..."
  }
}

This schema states a fact your API can defend.

Record what you checked and when

Provenance results can become stale. Tooling, certificate trust lists, and verification behavior can change.

Store:

• The verification status
• The timestamp
• The verifier version
• The signer, when available
• Validation errors, when available

Treat it like an antivirus scan result: useful, timestamped, and tied to a specific tool version.

Separate absent from broken

These states have different meanings:

Status	Meaning
verified	A manifest exists and validates.
absent	No manifest was found. This is uninformative about origin.
broken	A manifest exists but validation failed.
unchecked	Verification did not run or could not complete.

Do not collapse these states into a boolean. You lose important evidence when absent, broken, and unchecked all become false.

Fail open on the check, not on the content

If your verification service is unavailable, do not silently label every file as unverified.

Instead, surface the difference between:

• Verification completed and found no manifest.
• Verification completed and found a broken manifest.
• Verification could not be completed.

A minimal response shape:

{
  "asset_id": "img_9f2c41",
  "provenance": {
    "status": "verified",
    "standard": "c2pa",
    "signer": "Anthropic",
    "signature_valid": true,
    "checked_at": "2026-08-11T09:14:22Z",
    "tool": "c2patool/0.9"
  },
  "notes": "Provenance indicates the file was processed by Claude. It does not establish authorship."
}

The notes field is not decoration. If another team consumes this API, the caveat should be visible in the response data, not buried in documentation.

Testing the checks so they keep working

Provenance verification can quietly break.

For example, someone might add an image resize step, strip the C2PA manifest, and cause every asset to return status: "absent". Nothing necessarily throws an error, and dashboards may still look healthy.

Add these four assertions to your test suite.

1. Known-good fixture verifies

Upload a file with a valid manifest.

Assert:

{
  "provenance.status": "verified",
  "provenance.signature_valid": true
}

2. Known-stripped fixture reports absent

Upload the same file after removing metadata.

Assert:

{
  "provenance.status": "absent"
}

It should not return an error or verified.

3. Tampered fixture reports broken

Alter a byte in a signed file, then upload it.

Assert that the response reports a distinct broken or validation-failed state rather than absent.

4. Delivery round trip preserves the manifest

Upload a signed file, retrieve it through your normal delivery path, and verify the downloaded file again.

This catches regressions introduced by:

• Image resizers
• CDNs
• Format conversion
• Optimization middleware
• Storage transformations

For a deeper walkthrough, see your API is stripping C2PA metadata.

In Apidog, you can create a test scenario with binary fixtures, assert against the JSON response using standard assertions, and run it with apidog-cli in CI. This ensures a pipeline change that removes manifests fails the build.

The setup flow is similar to automating API tests in GitHub Actions. Download Apidog to build the scenario against your own endpoints.

FAQ

Is there an official Claude watermark detector?

Not publicly, as of August 2026. Anthropic has committed to supporting detection for users and third parties and says it will share details in forthcoming technical documentation.

Can I use an AI text detector to find Claude’s watermark?

No. These tools are statistical classifiers that guess whether text appears machine-written. They do not read Anthropic’s mark, and their false positives can disproportionately affect writers with unusual or highly formal styles.

How do I check a file for Claude’s C2PA metadata?

Run c2patool <file> locally, or upload the file to the Content Credentials verification page. Both report the signer and whether the signature validates.

If a file has no C2PA manifest, was it human-made?

No. Manifests are routinely destroyed by resizing, re-encoding, conversion, screenshots, and image CDNs. Their absence proves nothing about origin.

Does the text watermark survive editing?

Partially. It travels with copy-paste and may persist through some edits, but heavy paraphrasing, translation, or trimming to a short excerpt can push it below the detection floor. See does Claude’s watermark survive copy, paste, and editing.

What should I do until detection ships?

Verify C2PA where files are involved, log what you checked, and avoid policies that depend on detecting text. Design your API schema now so an official text verification step can be added later without breaking consumers.

The takeaway

Right now, you can verify Claude file provenance with standard C2PA tooling, but you cannot publicly verify Claude’s text watermark.

Build for that reality:

• Verify file provenance where possible.
• Return honest signals rather than authorship verdicts.
• Distinguish absent metadata from broken metadata.
• Test that image and delivery pipelines preserve manifests.
• Never treat a clean result as proof that content is human-made.

A mark is a hint about where content has been. It is not an authorship test.