How Claude's Invisible Watermark Works
On August 2, 2026, Anthropic began embedding invisible watermarks in all text generated by Claude. Here's a technical breakdown of how the system works.
Token-Level Statistical Watermarking
Claude's watermark operates at the token selection level during text generation. When Claude generates text, it doesn't just pick the most likely next word, it selects from a probability distribution of possible tokens. The watermarking system subtly biases these selections in a pattern that's invisible to humans but statistically detectable.
Think of it like a card dealer who appears to shuffle fairly but actually arranges cards in a pattern only they know. Each individual word looks natural, but across hundreds of tokens, the pattern emerges.
How the Pattern Survives
Unlike image watermarks that can be removed with a screenshot, the text watermark survives:
- Copy-paste: The pattern is in the words themselves, not hidden characters
- Format changes: Converting between document formats doesn't affect it
- Minor edits: Changing a few words doesn't break the overall pattern
What Breaks the Watermark
The watermark IS vulnerable to:
- Significant rewriting: Disrupting ~70% of token sequences breaks detection
- Non-Claude rewrites: Running text through a different AI model disrupts the pattern
- Paraphrasing: Heavy manual paraphrasing can degrade the signal
- Short texts: Texts under ~200 tokens don't carry enough signal for reliable detection
C2PA Content Credentials
In addition to the text watermark, Claude signs generated files (images, PDFs) with C2PA metadata. C2PA (Coalition for Content Provenance and Authenticity) is an open standard that embeds provenance information in file headers.
Unlike the text watermark, C2PA metadata is trivially removable, converting the file format, re-saving, or taking a screenshot strips the header entirely.
Why Anthropic Added Watermarks
The EU AI Act requires AI-generated content to be identifiable. Anthropic's watermarking system was introduced to comply with these regulations, initially for EU users but now applied globally to all Claude output.
Anthropic has stated the watermark is designed to be "robust but not unbreakable", acknowledging that determined users can remove it while making casual AI-generated content detectable.
Can the watermark actually be removed?
Partly, and it depends on which "watermark" you mean. Hidden characters and C2PA image metadata can be removed completely and reliably, they are discrete things in the file, and stripping them is deterministic. The statistical token watermark is different: it is woven into word choice, so the only way to disrupt it is to rewrite the text with a different model. Paraphrasing genuinely lowers the signal, which is why it is the standard approach in the research literature, but it is a reduction, not a guarantee, and a determined verifier with the private key may still find residual signal in lightly edited text.
Detection versus watermarking, not the same thing
It is worth separating three ideas that often get blurred together. Watermark detection means measuring the provider's own statistical mark, which needs their key. Hidden-character detection means scanning for invisible Unicode, which anyone can do. AI-writing detection means guessing whether text is machine-written from surface features, which is unreliable and produces false positives on human writing. When a product blends these together and reports one confident percentage, treat it with suspicion. The tools on this site keep them separate and tell you which one they are doing.