Where an AI watermark actually hides.

There are three kinds of AI watermark, in three separate places, and each one comes out a different way. This page shows you where each mark sits and exactly what we do to it.

Three marks, three places.

Paste text, or upload a text file, and you get hidden characters and the statistical watermark. A Word document gets hidden characters and metadata. A picture gets metadata alone.

Hidden charactersInvisible characters sitting between the ones you can seeDeleted and counted
MetadataA record inside the file’s wrapper saying what made itStripped, byte verified
Statistical watermarkThe choice of the words themselvesSanitised by an engineered rewrite

Hidden characters

Real characters, drawn as nothing at all.

Between the letters you can read, text can carry characters that display as nothing at all: invisible spaces, joiners, direction marks. They hold real positions in your text and travel with it through every copy and paste.

Many AI tools emit them, embedded in what you paste without you ever seeing it, and anyone who knows to look can check in seconds. They are the easiest tell to catch, and the easiest to remove completely.

What we do

Nine classes of invisible character checked on every scan
Each one named, with its exact position in your text
Read back afterwards to confirm none remain

Free, on every scan.

A hidden character takes a real position in the sentence and is drawn as nothing. We name it, point at it, and delete it.

Metadata

A signed record in the file’s wrapper, not in the content.

Every file carries a wrapper that describes it: what made it, when, with what. When an AI tool generates a file it writes a record into that wrapper naming itself. Claude does it, and so do OpenAI, Google, Adobe and the rest, most of them behind one shared industry format called C2PA.

We strip that record, along with EXIF, XMP and generator tags, then read the file back to confirm nothing is left. On a file Claude made, this is Claude’s mark coming off, with proof.

What we do

C2PA credentials, EXIF, XMP and generator tags removed
The picture or document returned byte for byte identical
The file re-read afterwards to prove it is clean

Needs a file. Pasted text has no wrapper to read.

The mark is not in the picture. It sits in the record attached to it, so removing it changes no pixel.

The statistical watermark

Nothing is added to your text. The mark is the words themselves.

This is the mark Claude, and others, apply to text itself: the one in the news, and the one nobody can point at, because nothing is inserted at any point. As a model writes it reaches words where several options read equally well, and a watermarking model hands that pick to a secret key. Across a few hundred words those picks line up into a pattern, and whoever holds the key can test any text for it.

The pattern lives only in unbroken runs of the original words, so a casual reword leaves it standing. Taking it off means rebuilding the wording, and that is what the section below does.

What makes it hard

Survives copy, paste, reformatting and light editing
Invisible to you, testable by whoever holds the key
Carried only by unbroken runs of the original words

Anthropic’s own words: a “complete rewrite where every word is replaced” defeats the mark. A casual reword never comes close to that bar.

A watermarked sentence is one the model could have written anyway. There is nothing extra in it to find, and nothing to point at.

How the rewrite works.

The signature travels in runs: unbroken stretches of the words the first model picked. Break the runs and there is nothing left to read it from. Here is what happens to your document, in the order it happens.

Where the mark can live

A watermark needs a choice to hide in.

When a model writes, some places leave it plenty of freedom and some leave it none. After “the sky was”, grey, overcast and gloomy all fit. After “the Treaty of”, there is one answer. A watermark works by nudging the pick, so it can only exist where there was a pick to nudge.

Which makes the job narrower than it looks. You do not have to rewrite everything. You have to rewrite the places where the model had freedom, and break the runs that carry the signal between them.

What we can measure, and what nobody can yet

Your document cannot be tested for the watermark itself. Anthropic’s detector is coming rather than callable, and nobody outside the labs can check a text for the mark today.

What can be measured is how much of your original word order survived, and that is the number that matters, because the signature cannot be read at all without unbroken runs to read it from. So every run hands you your own figures: the share of your wording replaced, the longest run of it still standing, every figure accounted for, and how much of your length was kept. Across our test set it breaks over 90% of three-word sequences with zero figures lost.

Where proof stands.

Two of the three are provable to the byte, today. The third becomes checkable the day Anthropic opens its detector, and that day is coming.

Hidden characters
Proven on every run. Found, counted, removed, and read back.
Metadata
Proven on every run. Verified against the raw bytes of your file.
Statistical rewrite
Measured on every run, and the section above is what the engine does to earn that. The one word we hold back is verified, because nobody can check a text watermark until Anthropic opens its public detector. The day it opens, we run every job against it.

Measured on real documents. Many documents, from 1,260 to 5,047 words: every figure intact, and 94 to 100% of the original length kept.

See what your own text is carrying.

The scan is free, takes seconds, and needs no account.

Run a free scan What we do

Hidden characters

Real characters, drawn as nothing at all.

What we do

Nine classes of invisible character checked on every scan
Each one named, with its exact position in your text
Read back afterwards to confirm none remain

Free, on every scan.

Metadata

A signed record in the file’s wrapper, not in the content.

We strip that record, along with EXIF, XMP and generator tags, then read the file back to confirm nothing is left. On a file Claude made, this is Claude’s mark coming off, with proof.

What we do

C2PA credentials, EXIF, XMP and generator tags removed
The picture or document returned byte for byte identical
The file re-read afterwards to prove it is clean

Needs a file. Pasted text has no wrapper to read.

The statistical watermark

Nothing is added to your text. The mark is the words themselves.

The pattern lives only in unbroken runs of the original words, so a casual reword leaves it standing. Taking it off means rebuilding the wording, and that is what the section below does.

What makes it hard

Survives copy, paste, reformatting and light editing
Invisible to you, testable by whoever holds the key
Carried only by unbroken runs of the original words

Anthropic’s own words: a “complete rewrite where every word is replaced” defeats the mark. A casual reword never comes close to that bar.

Where an AI watermark actually hides.

Three marks, three places.

Hidden characters

Metadata

The statistical watermark

How the rewrite works.

A watermark needs a choice to hide in.

What we can measure, and what nobody can yet

Where proof stands.

Hidden characters

Metadata

Statistical rewrite

See what your own text is carrying.

Where an AI watermark actually hides.

Three marks, three places.

Hidden characters

Metadata

The statistical watermark

How the rewrite works.

A watermark needs a choice to hide in.

Split

Freeze

Rewrite

Restore and check

What we can measure, and what nobody can yet

Where proof stands.

Hidden characters

Metadata

Statistical rewrite

See what your own text is carrying.

Split

Freeze

Rewrite

Restore and check