Claude / Anthropic · August 2026

Claude text watermark: how Anthropic's watermark actually works

Claude embeds a machine-readable mark in supported AI-generated text. Anthropic has now explained the mechanism class: keyed randomness influences which plausible next words Claude selects. The exact proprietary algorithm and detector remain private.

Updated 15 Aug 202614 min readPrimary-source based

Short answer: Anthropic has now confirmed that Claude's text watermark is a keyed statistical signal embedded through word/token choices during generation. It is not made of hidden Unicode characters or secret metadata. A detector with Anthropic's key can test how consistent a passage is with Claude having contributed to it. The exact proprietary algorithm, detector statistic and key-management design remain undisclosed.

Update: Anthropic has now explained the mechanism. Earlier Anthropic documentation described the watermark's behavior but not its mechanism. Anthropic's August 2026 technical explanation confirms that the signal comes from the model's token/word-selection randomness. ZK-F therefore no longer treats the statistical token-selection mechanism as inference. The exact proprietary implementation remains unknown.

Claude text watermark — current answers

Question	Current answer
Does Claude watermark text?	Yes, on supported/covered model outputs.
Is it hidden Unicode?	No.
Where is the signal?	In statistical word/token choices made during generation.
Does copy/paste remove it?	No.
Does light editing remove it?	Not reliably, according to Anthropic.
Can a complete rewrite remove it?	It can replace the original watermark-bearing choices.
Does it work equally well on code?	No; precise/low-entropy text offers less room for marking.
Is there a public detector?	Not yet. Anthropic says a free detection API/tool is planned.
Does detection prove Claude authored everything?	No. It indicates evidence of Claude involvement.

What Anthropic has confirmed

The August 2026 disclosure moves the high-level mechanism from inference into confirmed territory while still withholding the proprietary detector and security construction.

Confirmed

Keyed statistical word/token choices

During generation Claude often has several equally plausible next words. Anthropic says watermarking changes the source of the randomness used to settle those low-stakes choices — using a key and recent context — so a later check can ask whether the sequence is consistent with Claude's keyed pattern. Plain language: the mark lives in which synonyms and near-equivalent words Claude picked, not in extra hidden text. Anthropic's technical explanation ↗

Confirmed

No hidden Unicode or secret characters

Anthropic explicitly states that nothing is added to the text and there are no hidden characters. The Claude text watermark is not zero-width spaces, unusual Unicode, a hidden font, or metadata attached when you copy text. Unicode-cleaner websites that strip invisible characters therefore do not remove Claude's statistical watermark.

Confirmed

The detector is Claude-specific

A holder of Anthropic's key can estimate the likelihood that Claude was involved in writing or processing the text. A Claude watermark detector is an attribution test for Claude's marking process, not a universal “AI detector.” Other models would use different keys and may use different methods.

Confirmed

Longer text is easier to detect

Statistical evidence accumulates across many word choices. Short samples provide fewer decisions and less information. As a passage grows longer, confidence about Claude's involvement generally increases. ZK-F does not invent a hard token threshold beyond what Anthropic states.

Confirmed

Factual text and code carry less marking opportunity

Where only one continuation is correct — factual completions, exact names, or precise code that would break if changed — Anthropic says the watermark is not applied or is applied more sparsely. Comments or other arbitrary choices inside code can still carry signal, but overall marking opportunity is lower in constrained output. This matches the entropy trade-off explained in the LLM watermarking primer.

Confirmed

Light editing vs complete rewriting

Ordinary copy/paste does not remove the mark. Anthropic says light editing is unlikely to erase it completely, while a sufficiently complete rewrite that replaces every word can eliminate the original token-choice pattern. Once every word is replaced, whether the text is still “AI-generated” becomes a different question. Removal guide →

Confirmed

Applied at model level across surfaces

The watermark is intended to appear across supported Claude surfaces, including Claude products, the API, Claude Code, Cowork, Claude Tag, and supported cloud partner access, for models covered by Anthropic's rollout.

Confirmed

Ownership does not change

Anthropic says the watermark indicates Claude involvement or processing. It does not transfer ownership of user content to Anthropic and should not be described as proof that Claude is the legal author.

Coverage matters. Anthropic says models launched on or after 2 August 2026 support marking at launch, while support for earlier models is still being added. Absence of a detectable mark therefore cannot be treated as evidence that a text was not generated by Claude.

What Anthropic still has not disclosed

The high-level mechanism class is now public. The proprietary implementation details are not.

Unknown

Exact sampling construction

Known: keyed/randomized token-choice mechanism. Unknown: the exact algorithm; whether every production detail matches a named published construction; exact PRF/PRNG design; context window used for seeding; and any formal distribution-preservation guarantees Anthropic has not published.

Unknown

Detector statistic and calibration

Anthropic has not published the exact score, threshold, false-positive calibration, confidence bands, or minimum usable sample requirements beyond the qualitative length and entropy caveats already stated.

Unknown

Key hierarchy

Still unknown: keys per model, model family, rotation, deployment-specific keys, tenant/customer keys, regional keys, or issuance periods. Do not speculate.

Unknown

Security guarantees

Still unknown in public documentation: unforgeability, key-recovery resistance, detector-oracle resistance, adaptive removal resistance, and cryptographic undetectability to non-key-holders.

How does Claude's text watermark work?

Anthropic's explanation places Claude firmly in the generation-time statistical watermark family. The steps below follow that disclosure — they are no longer pure inference.

Step 1: Claude has multiple plausible next tokens

Like other large language models, Claude generates one word (or token) at a time. For many contexts several continuations are equally sensible — “overcast” versus “grey” after “The weather today was cold and…” — and ordinary generation settles the tie with randomness.

Step 2: keyed randomness influences the selection

With watermarking, those low-stakes choices are still random, but the randomness comes from a key plus recent preceding words rather than an arbitrary RNG. The model is not forced into obscure or unnatural words; it still chooses among candidates it would have considered anyway. Over many such decisions, a pattern forms that is invisible to readers but checkable with the key. Source: Anthropic ↗

Step 3: the pattern accumulates across the passage

One word is not a watermark. Evidence builds as more keyed choices accumulate. That is why longer passages generally support stronger detection, and why very short samples leave too little information.

Step 4: a detector with the key tests the resulting pattern

Detection is statistical and probabilistic: given the key, one can assign a probability that the observed sequence is consistent with Claude's keyed selection process. It does not return a metaphysical “AI vs human” label.

What this does not tell us: Anthropic still has not published the exact named proprietary construction, detector statistic, thresholds, or key-management design. Citing the DeepMind watermarking literature as technical context is not the same as publishing Claude's production parameters.

Does Claude use hidden characters?

No. Anthropic states that nothing is added to the text and there are no hidden characters. The Claude text watermark is a pattern in word choices, not zero-width Unicode, secret fonts, or appended invisible text.

Claude vs KGW vs SynthID Text

Claude belongs to the same broad family of generation-time statistical watermarks. Anthropic has not established that Claude uses the Kirchenbauer green-list construction or SynthID's exact production construction.

System	Publicly known mechanism	Exact detector public?
Claude	Keyed randomized/statistical token choice	Not yet publicly available
KGW	Context-derived green list + logit bias	Yes, research implementation
SynthID Text	Keyed scores + Tournament Sampling	Research method public; production keys private

Most defensible conclusion: Claude is in the same broad family of generation-time statistical watermarks, but Anthropic has not said that Claude uses KGW or SynthID's exact construction. Kirchenbauer / KGW → · SynthID Text →

What a Claude watermark detector can actually tell you

The detector should be framed as measuring evidence that Claude contributed to or processed the text, not as deciding “AI vs human.”

A positive result ≠ Claude authored every word.
A positive result ≠ every idea came from Claude.
Human-written content can be processed, edited or proofread by Claude — and may carry little or no detectable mark if Claude changed few words.
A negative result ≠ human-only text.
Low-entropy text and precise code may contain less watermark evidence.
Rewritten or mixed content may reduce evidence.

Detection remains statistical. Without Anthropic's published score, threshold and calibration, third parties cannot independently reproduce an authorized Claude watermark check.

Do not use an unofficial “Claude detector” as if it can read Anthropic's secret mark. Unless a tool has access to Anthropic's published detector, verification key, or approved detection API, it is most likely performing generic AI-text classification rather than Claude-watermark verification.

Can the Claude watermark be detected?

Yes, in principle — by a party that holds Anthropic's key and implements Anthropic's detector. Public third-party access is not yet available. See the detector status section below and the AI watermark detection guide.

Can editing remove the Claude watermark?

Anthropic's embedded text mark is not hidden Unicode or browser metadata. It is applied at model level during generation and survives ordinary copy/paste. Tools that strip zero-width spaces or normalize Unicode do not remove Claude's statistical watermark.

According to Anthropic's latest wording:

Light editing is not expected to reliably erase the signal.
A complete rewrite that replaces every word can eliminate the original watermark-bearing choices.
Heavy editing, paraphrasing, translation and mixing can leave a text without a detectable mark.

That describes reduced statistical evidence — not certifiable removal, and not proof that no other provenance evidence (such as C2PA on a file) exists. Without an authorized detector and published threshold, claiming successful removal is unsupported.

Do not conflate mark classes. Stripping invisible characters from AI text is a different forensic operation from weakening a generation-time token watermark.

Read the full AI watermark removal guide →

Does Claude watermark code?

Anthropic says marking is weaker or less frequent where an exact output is required and a different choice would be factually wrong or break code. Where arbitrary choices remain — for example comments — watermarking can still apply, but overall code carries less marking opportunity than open-ended prose.

Is there a Claude watermark detector?

Confirmed Anthropic says it plans to provide a free API/tool for checking Claude text watermarks so users and third parties can detect supported marks.

Unknown / not launched As of 15 August 2026, public third-party access is not yet available. Anthropic's technical post states that a watermark detection API is coming soon and that implementation details are still being worked out.

This means there is currently no official way for external parties to verify Claude's embedded text watermark with the same confidence as an authorized provider detector. Generic AI-text classifiers — tools that estimate whether prose resembles model output — are a different technology with different error modes. They should not be treated as Claude watermark verifiers.

Forensic caution: a positive result from an unofficial “Claude detector” is not evidence that Anthropic's secret watermark was detected. A negative result is not proof the text is human-written or unmarked.

Read the AI watermark detection guide →

Does a Claude watermark prove authorship?

No. A detected mark is evidence of Claude involvement or processing — not proof that Claude is the legal author, that every word originated with Claude, or that ownership changed.

Observation	Reasonable interpretation	What it does not prove
Supported Claude mark detected	The content may have been processed by a supported Claude system.	That Claude originated every word or idea.
No mark detected	No supported mark was recovered at the chosen threshold.	That the text is human-written or never touched Claude.
Weak / borderline signal	The passage may be short, edited, mixed, low-entropy, or simply unmarked.	Reliable attribution without additional evidence.
C2PA signature present on a file	A signed provenance assertion can be cryptographically checked.	That copied text outside the file preserves the same provenance chain.

Anthropic itself emphasizes this distinction: a detected mark is not fully conclusive provenance. Claude may have proofread, translated, summarized, or reformatted material whose underlying content came from elsewhere.

Claude uses two different provenance layers

Text watermarking is only half of Anthropic's 2026 content-marking architecture. For supported generated files, including SVG, PNG and JPG, Anthropic says Claude attaches signed provenance metadata following the C2PA standard.

Embedded text watermark

Lives in the generated text. Useful after copy/paste. Probabilistic. Can weaken after substantial rewriting.

C2PA signed provenance

Lives in a file's provenance manifest. Cryptographically verifiable. Can carry richer history, but may be stripped by conversion, screenshots, or workflows that discard metadata.

The two mechanisms are complementary. A file-level signature can make strong statements about a preserved artifact; a statistical watermark can remain present when plain text escapes its original container.

Read the full C2PA vs watermarking comparison →

Claude watermark FAQ

Does Claude watermark AI-generated text?

Yes. Anthropic says supported Claude models embed an imperceptible watermark directly into generated text at the model level through keyed word/token choices.

How does Claude's text watermark work?

Anthropic confirms a keyed statistical mechanism: when Claude chooses among multiple plausible next words, watermarking uses a key and recent context as the source of randomness. A key holder can later test whether the sequence matches that pattern. The exact proprietary algorithm remains undisclosed.

Does Claude use hidden characters?

No. Anthropic explicitly rules out hidden characters and added secret text. Unicode cleaners do not remove Claude's statistical watermark.

Can I detect a Claude watermark now?

Anthropic plans a free detection API/tool for users and third parties, but public third-party access is not yet available as of 15 August 2026. Unofficial tools are unlikely to verify Anthropic's actual watermark.

Is Claude's watermark based on Kirchenbauer et al.?

Not established. Claude's disclosed mechanism is in the same broad family of generation-time statistical watermarks as KGW and SynthID Text, but Anthropic has not said Claude uses the Kirchenbauer green-list construction.

Does Claude watermark code?

Marking is weaker where exact output is required. Precise code offers less room for keyed choices; comments and other arbitrary choices can still carry signal.

Can paraphrasing or editing remove the Claude watermark?

Light editing is unlikely to erase it completely. A complete rewrite can replace the original watermark-bearing word choices. Heavy editing, paraphrasing, translation, or mixing can leave a text without a detectable mark.

Does a detected Claude watermark prove Claude wrote the text?

No. It indicates the content may have been processed by Claude. It does not establish who authored the underlying ideas, whether humans edited the result, or who owns the content.

Is there an official Claude watermark detector?

Not yet for third-party use. Anthropic says a watermark detection API is coming soon. Unofficial tools should not be treated as Anthropic watermark verifiers.

Do invisible-character cleaners remove Claude's watermark?

No. Claude's mark is embedded in token/word choices during generation, not in zero-width Unicode characters.

Related ZK-F guides

01Anthropic — How Claude's text watermark worksOfficial technical explanation, 14 Aug 2026↗02Anthropic — How Claude marks AI-generated contentOfficial product documentation↗03Dathathri et al. — Scalable watermarking for identifying LLM outputsSynthID-Text, Nature 2024↗04Kirchenbauer et al. — A Watermark for Large Language ModelsCanonical green-list construction↗