Claude’s output is sometimes described as carrying a hidden watermark. That’s half true, and the half that’s wrong is the part people repeat most. The Claude watermark exists, but it isn’t a secret switch, it isn’t a set of invisible characters, and it doesn’t work the way a banknote watermark does.
Anthropic has published two pages on the subject, and both are specific. This post walks through what the company has actually stated and sorts it from the assumptions that fill forum threads and tool landing pages. Where I’m summarizing, I link the source so you can check the wording yourself.
Does Claude add a hidden watermark to its text?
Yes, but not the kind most people picture. Supported Claude models embed a statistical watermark in the text they generate. Nothing is added to the text and there are no hidden characters. The mark sits in which words Claude picks, and it can only be read by someone holding Anthropic’s key.
Anthropic explains the mechanism in How Claude’s text watermarking works. A language model writes one word at a time. Often it faces a choice between words that mean the same thing for the reader, such as “overcast” and “grey” after a sentence about the weather. Normally a random number settles that choice. With watermarking, the random choice is still made, but its source changes. A secret key and the few words just before the choice decide which word is picked.
Anyone with the key can later check a passage and ask whether its word choices line up with what the key would have produced. If they do, across enough choices, the passage can be given a probability of Claude involvement. Without the key the pattern is invisible. Anthropic also says the method doesn’t push Claude toward odd vocabulary, so an obscure synonym won’t suddenly appear just to carry the mark.
The company compares it to a board game. Swap the dice for a printed list of digits from pi and nobody at the table notices, because the moves still look random. But someone who knows where in pi you started can check afterward whether the game was played from that list.
The technique is a version of SynthID Text, published by Google DeepMind in a 2024 Nature paper. Anthropic says the family of methods goes back to a 2022 proposal by Scott Aaronson.
Common assumptions versus what Anthropic says
Most of the confusion comes from mixing up three different things: invisible characters, watermarks and AI detectors. The table below separates the claims I see most often from what the published pages say.
| Common assumption | What Anthropic has stated |
|---|---|
| The watermark is zero width characters | Nothing is added to the text, and there are no hidden characters. |
| It tells you who wrote or prompted the text | It carries no identifying information and can’t be traced to a person, organization or chat. |
| A positive result proves Claude wrote it | It only shows Claude was likely involved at some point. It can’t separate “Claude wrote this” from “Claude heavily edited this.” |
| No watermark means a human wrote it | Not so. Short passages, other AI models and heavy rewrites can all leave no detectable mark. |
| Anyone can scan a page for it | Detection is in private preview for eligible organizations such as regulators, media and researchers. |
| It makes Claude slower or more expensive | Anthropic says it needs no extra tokens and doesn’t change the price. |
| Only Claude does this | Other providers signed the same EU code and will use their own marks and keys. |
Why Claude is marking text at all
It’s a legal requirement, not a product experiment. Anthropic says it’s complying with the EU AI Act, and that it signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026 alongside about 190 other signatories. The rules for providers serving the EU market started applying on August 2, 2026, and the text of Article 50 is where the marking duty lives.
The mark applies worldwide, which surprises people outside Europe. Anthropic’s stated reason is that it doesn’t yet have a durable way to limit it by region. I’m not a lawyer, so if the rules matter for your business, read the code and the Act rather than my summary.
Are there hidden characters in Claude’s output?
Not as a watermark. But that doesn’t mean Claude’s text is clean. Curly quotes, non breaking spaces and the occasional zero width character still turn up in AI drafts for ordinary typographic reasons, and they still break search and replace, shortcodes and scripts. I wrote about that separately in the guide to AI watermark removers.
The distinction matters because it decides what a cleanup tool can do for you. Stripping invisible characters is verifiable. You can count them before and after. BleepingComputer’s investigation of watermark removers makes the same point: character stripping works, but the watermark lives in word choice, so no character cleaner reaches it. The same report says none of the removers’ claims about defeating the actual mark can be checked, because there’s no public detector to test against.
What decides whether the mark survives?
Detection gets stronger as text gets longer. Each low stakes word choice adds a little evidence, so a thousand words carry far more signal than two sentences. Anthropic says detection doesn’t work well on small samples.
Some text carries less mark than other text. Where only one word is correct, there’s no choice to nudge. Anthropic’s own example is a sentence about Newton’s best known book, where the next word has to be the right one. Factual passages, and code that must run exactly as written, therefore carry less. Comments inside code can still carry it, since the choice of wording there is free.
Proofreading is a quieter case. If you give Claude your own writing and ask it to fix grammar and punctuation only, nearly every word stays yours. The watermark can only live in the few words Claude changed, which may not be enough to register. Translation goes the other way. A translation produced by Claude carries the mark because Claude chose every word of it.
Editing sits between the two. According to Anthropic, light editing probably won’t remove the mark, and a full rewrite where every word is replaced will. In that last case, the company points out, it’s debatable whether the result is still AI generated text.
Which Claude models and products apply it?
Anthropic’s support page, How Claude marks AI-generated content, lists the models. Text watermarks apply to models launched on or after August 2, 2026, with older models being added. At the time of writing the list includes Claude Opus 5.5, Sonnet 5.5, Haiku 5.5, Fable 5.1 and Mythos 5.1. Older models such as Sonnet 4.6 and Haiku 4.5 were not yet marked for text. The page also notes that the rollout on Amazon Bedrock completes by October 17 for several models, so check it before assuming anything about a specific model.
Marking works wherever Claude runs: the API, Claude apps, Claude Code, Cowork and Claude Tag, plus Claude on AWS, Google Cloud and Microsoft Foundry.
Files get something different. Images and other supported file types receive a Content Credential, a signed note in the file’s metadata that follows the open C2PA standard. Anthropic stresses that this is not a watermark, since nothing in the file itself changes. It also disappears if you screenshot or re save the file, which is why metadata stripping is the easy part of what removers do.
How is this different from an AI detector?
Tools like Pangram don’t have Anthropic’s key. They look at the style of the writing, the phrasing habits that often give AI text away. Anthropic itself names two: the “this isn’t X, it’s Y” construction, and a fondness for the word “quietly.” Spotting those habits is a guess about style. Checking a watermark is a statistical test against a key. They answer different questions and can disagree.
Why this matters in real publishing work
A draft rarely travels from generation to publication in one clean jump. I might generate an outline, edit it, paste it into a document, move selected sections into WordPress, and then adjust headings and links. Every transfer is an opportunity for formatting to change.
That’s why I prefer a repeatable workflow: inspect, normalize, review, publish. It’s less exciting than a claim about a secret switch, but it’s much easier to test and maintain. And it keeps two jobs apart that people often blur. Technical cleanup fixes how text behaves in a CMS. Disclosure decisions are about honesty, and no cleanup step settles them.
A practical checklist
| Stage | My check | What goes wrong if I skip it |
|---|---|---|
| Original | Keep an untouched copy before making changes. | You can’t tell later which edit broke something. |
| Technical | Inspect characters, whitespace, encoding and formatting. | Curly quotes and odd spaces reach shortcodes and scripts. |
| Editorial | Check accuracy, clarity, tone and usefulness. | Confident sounding errors go live under your name. |
| Privacy | Consider whether the material is appropriate for the processing environment. | Client drafts end up on a server you never vetted. |
| Publication | Preview the final page and test links and formatting. | Broken links and mangled quotes show on the live page. |
Run the technical step first, because a quick scan tells you what you’re dealing with. This takes a few seconds in Python:
text = open("draft.txt", encoding="utf-8").read()
print(sorted(hex(ord(c)) for c in set(text) if ord(c) > 127))That lists every non ASCII character in the draft. On a clean Claude paragraph you’ll typically see a handful of quotes and dashes, and nothing that looks like a payload. That matches what Anthropic says: the mark isn’t stored as extra characters, so a character scan can’t find it, and a character cleaner can’t remove it.
Key takeaways
- Anthropic’s own pages are the reliable source. Secondhand summaries drift fast.
- The Claude watermark lives in word choice. It isn’t a set of hidden characters, so character cleanup doesn’t touch it.
- A positive result means Claude was likely involved at some point. It doesn’t prove Claude wrote the text, and a negative result doesn’t prove a human did.
- The rollout is still moving. Model coverage and detector access have changed within weeks, so recheck before you rely on any claim.
Frequently asked questions
Where should I look for Anthropic’s official position?
Start with Anthropic’s explainer on text watermarking and the support page on how Claude marks content. The support page carries the current model list and was updated recently, which is exactly why older blog summaries can be wrong.
Does a watermark mean every output can be traced back to me?
No. Anthropic says the watermark carries no identifying information and can’t be tied to a specific person, organization or chat. It only supports a probability that Claude was involved in the text.
Can I check my own text for the watermark?
Not yet, unless you qualify. The detection API is in private preview for eligible organizations, including regulators, media, fact checkers, researchers and educational groups, plus enterprises with their own obligations under the EU Act. Any free site claiming a definitive Claude check deserves suspicion, since it can’t have the key.
Will translating or proofreading with Claude leave a mark?
Translation will, because Claude chooses every word. Light proofreading of your own writing may leave too little for a detector to register, depending on length and how much Claude changed.
Does this change who owns the text?
No. Anthropic says a watermark only helps test whether Claude may have produced or processed content. It doesn’t speak to ownership or authorship, and it doesn’t change your rights under the terms.
Should I assume this stays accurate long term?
No. The model list, the regional scope and the detector access have all been updated since the first announcement. Check the current pages rather than an older post, including this one.
Final thoughts
Claims about AI watermarking spread faster than the facts behind them change. The shortest path to staying accurate is to read the source, then test what you can test yourself. You can’t see the Claude watermark, and you can’t remove it by deleting characters. You can keep your own text clean, check your own claims and decide, as a publisher, what you owe your readers.