Claude's Invisible Watermark: What It Is and What It Means

What Did Anthropic Just Announce?

On August 2, 2026, Anthropic started marking the text its newest models produce. The company lays out the mechanism in its support article "How Claude marks AI-generated content" (support.claude.com): "When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself." The announcement spread fast, going viral within hours and picked up by 15 or more outlets the same day.

The reason is regulatory. Anthropic signed on to the transparency commitments in the EU AI Act, whose Article 50(2) requires that a provider's outputs "are marked in a machine-readable format and detectable as artificially generated or manipulated." Rather than limit this to European users, Anthropic rolled it out worldwide, and rather than attach it to a single app, the company built the mark in at the model level. In its own words: "Watermarking will be applied at the model level, which means it will be present no matter which Claude product or surface the text comes from." Practically, that means the same signal is present whether the words came from the Claude app, the API, a coding assistant, or any other surface built on a supported model.

Anthropic also describes how durable the mark is in ordinary handling: "Because the watermark is part of the text, it will travel with the text when it's copied and pasted elsewhere, and may persist through some editing." Copy a paragraph out of Claude into an email or a document and, on a supported model, the signal rides along inside the words.

Files are a separate story with a separate mechanism. Images that Claude generates carry C2PA provenance metadata (the Coalition for Content Provenance and Authenticity, an open standard for tagging where a file came from). Because C2PA data sits in the file's metadata rather than inside the words, it is comparatively fragile: re-saving, converting to another format, or even screenshotting the image can strip it out. The text watermark is the opposite kind of object. It lives inside the writing, and it is the part this article is about.

Does My Old Claude Text Have a Watermark?

This is the detail most coverage skipped, and it decides whether your existing documents are affected at all. The mark is gated by the launch date of the model, not by the date you generated the text. Anthropic states the boundary plainly: "Claude models launched on or after August 2, 2026 will support machine-readable marking at launch."

Read that sentence closely, because the wording is load-bearing. A model that launched before August 2, 2026, and has not been updated to add marking, produces unmarked text. So an essay, an email, or a report you generated with an earlier Claude model does not retroactively acquire a watermark because of this policy. The policy is not scanning your old files, and it is not reaching back in time. Only text produced by a supported, newer model carries the signal.

For most readers worried about work they already turned in, that is the reassuring answer: it is very likely unmarked. Going forward, the text to think about is fresh output from the newest models. If you are unsure which model produced a given passage, the safe rule of thumb is simple. Anything generated before the August 2 cutoff is unmarked, and anything you generate now from a current model may be marked. The change is a line in time, not a sweep of your history.

Can GPTZero or Turnitin Detect the Claude Watermark?

Short answer: no, and it is worth understanding why, because conflating the two ideas causes a lot of needless worry. I built the pattern-detection engine behind our internal detector, so I know firsthand what that class of system can and cannot see. Tools like GPTZero, Turnitin, Originality, and the proprietary detector behind /detect read the writing style of a passage. They score statistical properties such as sentence-to-sentence variance, word-choice distribution, and rhythm, then estimate whether that profile looks machine-written. Not one of them looks for Claude's embedded mark, because that mark is a different kind of object entirely, sitting at the level of the individual tokens the model chose. (I build style detectors, not watermark cryptography, so I will not pretend to hold the keys either.)

That is a genuinely different technology, and there is a second reason these detectors cannot read the mark: no public reader for Claude's watermark exists yet (more on that in a moment). So two independent facts hold at once. Passing a style-based detector tells you nothing about whether the watermark is present, and finding the watermark would tell you nothing about a style score. They answer separate questions with separate machinery, and no tool on the market today bridges them.

One reassurance for a specific reader. If you write in English as a second language and a detector has flagged your own original writing, this new watermark is not what happened to you. Style-based detectors over-flag non-native English prose because of the way they read cadence and word choice, a documented bias we cover in detail in our analysis of ESL false positives. That is a completely different mechanism from the token-level mark described here. Your own unassisted writing carries no watermark of any kind, from Claude or anyone else, so a style-based flag is a fixable stylometric problem, never a hidden signal you were tagged with.

How Does an Invisible Text Watermark Work, and Does Rewriting Remove It?

Here is the mechanism, kept at the level that is actually defensible. A token-level text watermark is carried in the specific words a model picks as it writes. As the model chooses each next word, it nudges those choices in a structured, statistically detectable pattern, so the fingerprint lives inside the sequence of words themselves rather than in any hidden character or metadata tag. If you want the deeper cryptographic detail, our companion explainer on the ChatGPT watermarking question walks through how the underlying token-sampling schemes work at /blog/chatgpt-watermark-explained. The short version is all we need here: the signal is made of the words the original model chose. For how Google's Gemini answers the same question, see our companion explainer at /blog/gemini-watermark-explained.

That single fact tells you what does and does not disturb it. Light touch-ups (fixing a typo, swapping one word, trimming a sentence) leave most of the original words in place, so most of the signal survives. This is exactly why Anthropic warns the mark "may persist through some editing." Replacing the words wholesale is the operation that matters, and on that point both companies that have publicly built a text watermark say the same thing. Anthropic's own Limitations list names, as a reason a mark may not be detected, that "The text has been heavily edited, paraphrased, translated, or mixed into other writing." OpenAI, explaining to the Wall Street Journal in 2024 why it never released the text watermark it had already built, conceded that a determined user could defeat it simply by passing the output through a different model or a paraphraser. When two of the three largest labs independently name the same operation, the mechanism stops being speculation and starts being documented.

This is where our tool fits, stated plainly and inside its limits. Our humanizer at /humanize takes a draft you paste in and rewrites it from scratch in its own model's words, rather than lightly editing the text you gave it. That is precisely the operation Anthropic and OpenAI describe: a different model choosing all-new words, so the mark that lived in Claude's specific word choices is not part of the new text. The useful way to think about it is as a workflow step for making the final wording your own, not as a trick to pull on anyone. It is also worth being precise about the law, because the framing matters: Article 50(2) puts the duty to mark on the provider, which is Anthropic, not on you to preserve a mark in text that you rewrite and publish as your own work.

Two honesty guardrails on that claim. I will not overstate it as absolute, and I will not quote you a removal percentage, because there is no public detector to measure one against yet. What I will stand behind is grounded: our system regenerates a pasted draft from scratch in its own model's words, and that is the specific operation both labs name as defeating a token-level text watermark.

Is There a Claude Watermark Detector or Remover?

No public detector exists today. Anthropic says it is still building the reader: "We're also working to enable users and other third parties to detect Claude's embedded watermarks and provenance metadata." That sentence is in the future tense for a reason. Until the tool ships, nobody, us included, can run a real before-and-after measurement on an actual Claude watermark this week. Every persistence claim and every removal claim making the rounds right now, including the reasoning on this page, rests on the mechanism plus the labs' published documentation, not on a lab result anyone can currently produce.

I want to be direct that this limitation is a strength of this article, not a dodge. It would be easy to fabricate a tidy "we ran the detector and it came back clean" figure. There is no detector to run, so any such number would be invented, and you should distrust any page waving one around this week. It also helps to keep Anthropic's own calibration in view even for the future. The company says a detected mark "provides a signal that content was processed by Claude, but is not fully conclusive." So even once a reader is public, a hit will be evidence rather than a verdict, and the absence of a hit will not be proof either. That is the correct answer to "surely a detector will just settle it": it will inform the question, not close it.

Here is our commitment. When Anthropic's detector becomes publicly available, we will test our own regeneration against it and publish exactly what we find, whether the result supports our reasoning or complicates it. You can hold us to that. Our sourcing method and how we log corrections are documented at /methodology, which is the honest alternative to a fabricated benchmark.

What Happens Next?

Two developments are worth watching. First, detection tooling is coming. Anthropic has committed to letting users and third parties read the mark, and once that reader is public the whole conversation moves from mechanism to measurement. That is the moment to revisit this topic, because claims about persistence and removal will finally be testable rather than argued from first principles.

Second, the compliance calendar is still unrolling. The August 2, 2026 milestone applies to newly launched models. Under the EU AI Act's phased timeline, systems that were already in place before that date get a grace period running into December 2026 to add machine-readable marking. Expect more providers to announce text marking as that deadline approaches, and expect the industry norm to drift from no marking toward marking by default. Anthropic is early here, not alone.

For a writer, the sensible posture is calm and informed rather than alarmed. Know that the newest Claude models mark their text, know that your older Claude text almost certainly does not, know that your own unassisted writing never does, and know that rewriting a draft in a different model's words replaces the words any mark lived in. When a real detector ships, we will put that last point to the test and report the result here, win or lose.

Written by Fırat Mıhcı (ResearchGate). Sourcing note: every factual claim above ties to a named primary source, chiefly Anthropic's support article 16266773 ("How Claude marks AI-generated content"), Article 50(2) of the EU AI Act, and the Wall Street Journal's August 4, 2024 report by Deepa Seetharaman. We are paid nothing by any company named here. Published August 11, 2026, and we will update it when a public Claude watermark detector arrives.