Claude Watermark Remover & Detector

Does Claude Add Invisible Watermarks to Its Text?

Anthropic has confirmed that Claude watermarks its text, and has been explicit about how it works: where several words would fit equally well, a cryptographic key plus the words already written decide which one Claude picks, leaving a verifiable pattern across the passage. Anthropic’s own wording is unambiguous — nothing is added to the text and there are no hidden characters. No character scanner, this one included, can see that watermark, and no character cleaner can remove it.

The mark is densest in free-flowing prose, sparser in factual passages and close to absent in code, where the wording is forced. Light editing weakens it; only a rewrite that replaces every word removes it. It carries no identifying information and cannot be traced to a person or a chat, and for now only Anthropic can verify it — a detection API has been announced but is not public yet. What this tool handles is a separate, far more mundane problem: the zero-width characters that rich-text copy-paste leaves in Claude output on its way into your documents, which survive invisibly into Google Docs, email clients and CMS editors and only surface when a diff tool or a compiler trips over them.

Can Claude’s Watermark Be Removed or Detected Without Anthropic’s Key?

Three questions people actually ask about it, answered against the published research rather than against what watermark-remover pages tend to promise.

Can it be removed?

Not by deleting anything, because there is nothing to delete. The signal is spread across hundreds of word choices, so how much of it survives is roughly proportional to how much of the wording you replace: light editing weakens it, paraphrasing degrades it in proportion to the tokens swapped, and only a rewrite that replaces every word removes it outright. Short, factual or code-heavy passages carry little signal in the first place — the wording there is forced, so there were few free choices left to encode anything into.

Can it be detected without the key?

Verifying one specific passage: no. That needs Anthropic’s key, and Anthropic has announced a detection API without shipping it yet. Establishing that a model watermarks at all is a different problem, and there the answer is yes. These schemes leak because the choice is deterministic for a fixed preceding context, so repeated probing exposes the bias. Black-Box Detection of Language Model Watermarks (SRI Lab, ETH Zurich) builds statistical tests that detect the presence — and estimate the parameters — of all three watermarking families from black-box API queries alone. The same group probed Gemini in production and confirmed Google’s SynthID watermark at p ≈ 0, no key involved. Watermark Stealing (ICML 2024) goes further: an approximate copy of the secret rules can be learned by querying the API for under $50, with around 80% success at both spoofing and scrubbing.

The distinction is the whole point. Those results establish that a model watermarks, not that this paragraph came from it, and a stolen approximation of the rules yields a noisy detector — nowhere near a basis for accusing a particular person of anything. The known mitigation, caching repeated contexts so probes keep returning the same answer, raises the cost of the probing without closing it.

Do invisible characters break it?

Against a naive detector, yes. Against a normalizing one, no. The watermark is scored over tokens, and each token’s score depends on the tokens before it, so a zero-width character inserted between words re-tokenizes the text: it changes the token being scored and corrupts the context window for the tokens that follow. Homoglyphs do it more violently still — swapping the Latin letters in “Lighthouse” for Cyrillic look-alikes turns 2 tokens into 9.

The defense is one line of preprocessing: canonicalize the text before scoring it — strip zero-width characters, apply Unicode normalization, map confusables. That has been the standard recommendation since the first LLM watermarking paper, and zero-width tricks are precisely the fragile ones under it. The attack also defeats itself: text stuffed with invisible characters is trivially detectable as manipulated — by this scanner, in your browser, with no key and no API. You trade “possibly written with Claude” for “visibly tampered with”.

Which puts this tool in a position worth stating plainly: removing invisible characters is the same preprocessing step a watermark detector runs first. Cleaning the text does not take it out of the watermark. It returns the text to the canonical form where the watermark reads most clearly.

Invisible Characters Reported in Claude Output

These are the hidden characters users report finding in text copied from Claude. The scanner above highlights them automatically when they appear in your paste:

How to Remove Watermarks from Claude Text

1. Copy the text out of Claude and paste it into the tool above
2. Open the Scan tab to see every invisible character it carries (optional but recommended)
3. Open the Remove tab and click Remove invisible characters
4. Copy the clean text — the visible wording is untouched

Everything runs locally in your browser, so the text never leaves your device.

What this does not do: This removes invisible characters only. Anthropic’s watermark lives in Claude’s word choices, not in characters, so it passes through this — and any other character-level cleaner — untouched.

When Claude Text Needs Cleaning

• Long-form articles — Claude is a popular drafting tool; invisible characters pasted into WordPress or Ghost can break search and excerpts.
• Professional and legal drafts — hidden characters in contracts or filings create diff noise and version-control confusion.
• Documentation — zero-width characters in README files and wikis break anchors, search and copy-paste for the next reader.
• Code and config — a zero-width character inside a Claude-generated config file can fail silently in production.

Frequently Asked Questions