How to Remove the Claude Watermark?

How to Remove AI Watermarks from Text and Files with watermarks-remover

As of August 2026, Claude-generated text carries an invisible watermark. You cannot see it, spell-checkers will not flag it, and it survives copy-paste from Claude into another document. Anthropic designed this watermark so AI-generated text can be statistically traced back to the model.

Try Apidog today

If you need to clean text or files that you own, the open-source watermarks-remover project provides utilities for removing invisible characters and file metadata. This guide explains what Claude's watermark is, what the tool can remove reliably, and how to run it.

Use these techniques for privacy and hygiene on content you own. Do not use them to evade academic disclosure requirements, contractual AI-use terms, or platform policies.

TL;DR

• Claude's text watermark: A statistical signature created through token-selection bias. It is not a hidden character that you can locate and delete.
• Copy-paste: The text watermark survives copy-paste because it is encoded in word choice.
• Editing: Paraphrasing, translation, and substantial editing can degrade the statistical signal.
• Layer A: Reliably removes invisible Unicode characters, unusual spaces, bidirectional controls, and Unicode tag characters.
• Layer B: Rewrites text to disrupt statistical watermarks. It is best-effort and can reduce quality or change meaning.
• File cleanup: Removes C2PA, EXIF, XMP, and document metadata from supported image and document formats.
• Verification: Deterministic character and metadata removal is easy to verify. Statistical watermark removal cannot be independently confirmed without the vendor's detection key or API.

What Claude's watermark actually is

Claude's text watermark is not a sequence of zero-width spaces or hidden glyphs embedded between words.

Instead, it affects the words Claude chooses while generating text. At each generation step, the model selects from statistically similar token candidates. A secret key biases some of those choices. Across a sufficiently long passage, those biased selections create a detectable statistical pattern.

This design has two practical consequences:

• It survives copy-paste. The signal is in the generated wording, not in document metadata.
• It weakens after editing. Changing enough words through paraphrasing, translation, or manual edits disrupts the pattern.

Anthropic rolled this out at the model level starting August 2, 2026. That means the mark applies across Claude apps, the API, Claude Code, and third-party access through AWS, Google Cloud, and Microsoft Foundry. Anthropic has said that a detection API is coming.

For related context on Anthropic's model access policies, see Fable 5 Is Down for Everyone.

A positive watermark detection only means text may have passed through Claude. It does not prove misconduct or identify who authored the final content.

Two watermark types, two different fixes

watermarks-remover separates cleanup into distinct layers because text watermarks and file provenance metadata use different mechanisms.

Layer A: deterministic character cleanup

Layer A removes:

• Zero-width Unicode characters
• Exotic whitespace
• Bidirectional text controls
• Unicode tag characters

This pass is deterministic and lossless: it removes non-visible characters without rewriting visible prose. It is the reliable part of the workflow.

Layer B: statistical rewriting

Layer B targets token-sampling watermarks such as Claude's statistical text watermark.

Because the signal is distributed across word choice, there is no single character or metadata field to delete. The only practical method is to rewrite the text.

This approach has trade-offs:

• It can flatten the original writing style.
• It can subtly change technical meaning.
• It cannot guarantee that a statistical detector will no longer recognize the text.

File metadata cleanup

The tool can also remove file-level metadata, including:

• C2PA manifests
• EXIF metadata
• XMP metadata
• Embedded document properties

Supported formats include PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown.

C2PA is a Coalition for Content Provenance and Authenticity manifest stored with a file. Unlike a statistical text watermark, it is generally easy to remove through a format conversion, re-save, or dedicated metadata cleanup process.

The project also covers Claude, Gemini/SynthID-Text, OpenAI, and Kirchenbauer-style open-source marks using the same architecture. Pixel-level image watermarks such as SynthID are out of scope for removal, although the project can optionally score them through an external reverse-SynthID checkout.

When the watermark is already weak

Before adding a cleanup step, check whether there is enough signal to matter.

Claude's statistical watermark is often weak or absent in these cases:

• Short passages: A few sentences may not contain enough token choices for reliable detection.
• Source code: Code has constrained token choices, and formatters, linters, and refactoring tools can remove most remaining signal.
• Heavily edited prose: If you substantially rewrote the draft, the statistical pattern may already be degraded.
• C2PA-tagged files: Re-saving or converting a file often removes the manifest.

In practice, cleanup is most relevant for long-form prose that remains close to the original generated text, plus file-level metadata.

Install watermarks-remover

The project ships as an agent skill and as standalone Python scripts.

Requirements:

• Python 3.10 or later
• No pip install step for core text and metadata cleanup

Clone the repository:

git clone https://github.com/guillaumemeyer/watermarks-remover.git
cd watermarks-remover

If you use the repository as an agent skill, link the skill directory:

mkdir -p ~/.grok/skills
ln -sfn "$(pwd)/skills/remove-ai-marks" ~/.grok/skills/remove-ai-marks

For direct script usage, set a shell variable for the scripts directory:

export SCRIPTS="$(pwd)/skills/remove-ai-marks/scripts"

Optional tools:

• c2patool for inspecting C2PA manifests
• exiftool for removing residual image metadata

Neither optional dependency is required for the core workflow.

Inspect a file before changing it

Start with inspection. This lets you identify invisible characters, metadata, and provenance manifests before modifying the file.

python3 "$SCRIPTS/inspect_file.py" draft.md

The inspector reports detected content without changing the file. If the file is already clean, no further action is needed.

Remove invisible characters from text

Use clean_text.py for deterministic Layer A cleanup.

python3 "$SCRIPTS/clean_text.py" draft.md -o draft.cleaned.md --stats

This command removes invisible Unicode, unusual spaces, bidirectional controls, and tag characters.

The --stats flag prints a summary of detected and removed content. The -o flag writes a new output file, so you can inspect the result before replacing the original.

For hidden-character cleanup, this is typically the complete workflow.

Strip metadata from files

Use clean_file.py to remove C2PA, EXIF, XMP, and document properties.

python3 "$SCRIPTS/clean_file.py" photo.png -o photo.cleaned.png

The script supports PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown.

If exiftool is installed, run it after cleanup for an additional metadata pass:

exiftool -all= photo.cleaned.png

C2PA is the straightforward case: a format round-trip may remove it, but a dedicated cleanup command is more predictable and easier to automate.

Layer B: rewrite text to disrupt statistical signals

For a best-effort paraphrase workflow, use rewrite_text.py:

python3 "$SCRIPTS/rewrite_text.py" draft.md --backend print-prompt --strength paraphrase

With --backend print-prompt, the script prints a rewriting prompt instead of calling a model. You can then choose the rewriting system and review the result yourself.

The --strength option controls how aggressively the text is reworded.

Before using Layer B, account for the trade-offs:

• Style loss: The original phrasing may be part of what makes the writing effective.
• Precision risk: Technical language can become less accurate after paraphrasing.
• No guaranteed verification: Without Anthropic's detection key, you cannot independently confirm that the statistical watermark is gone.

A practical default is:

1. Run Layer A for hidden-character cleanup.
2. Clean file metadata when publishing images or documents.
3. Use Layer B only when you have a legitimate reason to rewrite the content and can review the result carefully.

Verify the output

Re-run the inspector after cleanup:

python3 "$SCRIPTS/inspect_file.py" draft.cleaned.md

For C2PA manifests, use c2patool:

c2patool photo.cleaned.png

For statistical text watermarks, verification is harder because Anthropic's detection key is not publicly available. Until its promised detection API is available, treat Layer B results as unconfirmed.

If you automate content checks, add inspection and verification steps to your pipeline. Teams that test model-backed workflows can use an API testing tool such as Apidog to make those checks repeatable. For a broader API-testing workflow, see How to Test AI Agents Over an API.

Legal and ethical guardrails

Use this tooling for privacy and hygiene on your own content. Reasonable use cases include:

• Removing tracking characters from drafts you own
• Cleaning image metadata before publishing
• Removing document properties from files you distribute
• Managing provenance metadata under your own publishing policy

Do not use it for:

• Academic dishonesty: Removing a mark does not remove an institution's disclosure requirements.
• Contract violations: Client agreements and platform terms may require AI-use disclosure.
• False attribution: Passing AI-generated work off as human work can materially mislead others.

Watermark detection is not definitive proof of authorship, and the absence of a watermark does not prove human authorship. When disclosure is required, disclose.

If your goal is to control the model, data, and provenance policy from the start, self-hosting may be a better fit. See The Best Local LLMs to Run in 2026.

FAQ

Can I find and delete hidden watermark characters in Claude text?

No. Claude's text watermark is a statistical bias in token selection, not a sequence of hidden characters. Layer A can remove invisible characters inserted by other systems, but that is a different mechanism.

Does copy-pasting Claude output remove the watermark?

No. The statistical signal is encoded in word choice, so it survives copy-paste between applications.

Is watermarks-remover free?

Yes. It is open source under the MIT license. Core text and metadata scripts require Python 3.10+ and the standard library.

Does it work on Claude Code output?

The scripts can process code, but the watermark is often too weak to matter in source code. Constrained syntax, formatters, linters, and refactoring tools tend to erase the already limited signal.

Can it remove pixel-level image watermarks such as SynthID?

No. It removes file-level metadata such as C2PA, EXIF, and XMP. Pixel-domain watermark removal is out of scope, although the project can optionally score SynthID marks with an external setup.

Is watermark removal legal?

Removing provenance metadata from content you own is not inherently illegal. However, it may violate academic policies, contracts, or platform rules that require AI disclosure.

How can I confirm that a statistical watermark is gone?

Currently, you generally cannot confirm it independently because you do not have the detection key. Anthropic's planned detection API would be the relevant verification mechanism. Layer A cleanup and C2PA removal, however, can be verified with inspect_file.py and c2patool.