Claude now watermarks everything it writes. Here is the five minute setup that cleans it, what the watermark actually is, and why the usual tricks do nothing.
On August 11 Anthropic announced that Claude is going to start watermarking the text it writes, and unlike most AI news this one affects you the moment you paste something into a doc. The reason it is happening now is the EU AI Act's Transparency Code, which came into force on August 2 and pushes the big labs to make AI generated content identifiable.
Google already does this with Gemini, Anthropic is rolling it out now, and it is safe to assume OpenAI and everyone else follows within the year. So this is not a Claude problem you can dodge by switching tools, it is where the whole industry is heading.
Heads up. Pasting your text into Notepad and copying it back out does nothing to this watermark. Neither does saving it as a different file type, or retyping the sentences by hand. Those worked on the older invisible character marks. The new one lives somewhere else entirely.
Setting It Up
A developer called Guillaume Meyer published a free open source Claude skill called watermarks-remover. The skill inside it is called remove-ai-marks. This takes about two minutes and it is all point and click.
- Go to https://github.com/guillaumemeyer/watermarks-remover in your browser.
- In the file list, click the row labelled skills/remove-ai-marks.
- Open the file called SKILL.md.
- Top right of that file, click Download raw file. The SKILL.md lands in your downloads.
- Go to Claude, click Customize, then Skills.
- Hit Add in the top right, choose Upload skill, then drag the SKILL.md straight in.
Turn on code execution while you are in there, under Settings then Capabilities. The skill uses it to do the cleaning, and if it is off you get a refusal that looks like the skill is broken when it is just a setting.
Want the full version too? The single file above gives you the text cleaning, which is what most people came for. If you also want the file tools, the ones that strip content credentials out of images and PDFs and audit a whole folder at once, grab the repo instead. Click the green Code button, then Download ZIP, unzip it, zip up just the remove-ai-marks folder, and upload that zip the same way.
Using It
Type the slash command, then paste your text or attach your file. It runs an inspection first and tells you what it found before it changes anything.
Read the inspection report rather than skipping past it. It gives you a count of the invisible characters it found and a list of any metadata worth stripping, and those numbers are real rather than estimated.
The rewrite pass
For prose it will then offer you the rewrite, and this is where you make a judgement call. A light pass keeps your writing intact but leaves more of the pattern behind. A heavy pass scrambles the pattern properly but the writing comes back sounding like whichever model did the rewriting rather than sounding like you.
This is the paraphrase prompt the skill uses:
And the stronger one, which reads better but drifts further from what you originally wrote:
Run the invisible character clean again after any rewrite. The rewriting model is an AI too, so it will happily put a fresh set of odd characters back into your text on the way out.
What The Watermark Actually Is
When Claude writes a sentence there are usually several words that would fit equally well in any given spot, and the model is picking between them based on probability. The watermark works by nudging that choice using a secret key, so across a long enough passage the pattern of which near equivalent words got picked forms a signal that a detector holding the key can spot.
The text reads completely normally and no individual word looks unusual, because the signal only exists in the pattern across hundreds of words.
The simple version. The watermark is not sitting in the file, it is sitting in the word choices themselves. Less like a stamp on the paper, more like a handwriting style running through the whole page.
Anthropic has said it works at the model level rather than inside any one app, which means it is there whether the text came out of the Claude app, the API, Claude Code, or Cowork. Every model released after August 2 has it built in and they have said older models are getting it too.
What actually weakens it
- Fixing a typo or tweaking a few words: barely touched. Most of the original word choices are still sitting there.
- Changing headings and formatting: no effect. The signal is in the prose, not the layout.
- Rewriting heavily in your own words: genuinely disrupted. You are replacing the choices that carried the pattern.
- Short text, a few sentences: hard to read either way. Not enough words for the pattern to be reliable.
- Code: weak to begin with. Little room to nudge word choice, and formatters strip the rest.
It works in three layers, and they are not equally reliable.
- Layer A, invisible characters. Zero width spaces, narrow spaces, bidirectional marks and other odd Unicode that AI tools slip in. Verifiable, it counts exactly what it pulled out and shows you.
- Layer B, the statistical watermark. The word choice pattern, attacked by getting a second AI to rewrite your text. Best effort. Nobody outside the vendors can currently confirm it worked.
- Layer C, files. C2PA content credentials, EXIF and XMP metadata in PNG, JPEG, SVG, PDF, DOCX, ODT, HTML and MD. Verifiable, it reports each field it stripped.
Even though the new watermark is not made of invisible characters, AI tools do still leave those characters in your text, and they are a strong tell on their own. They also break things. Paste one into a CMS or a code editor and you get formatting bugs you will spend an hour hunting.
For Layer B, rewrite with a different model than the one that wrote the text. Claude text should not get rewritten by Claude, because you would just be swapping one model's marks for the same model's marks.
Where People Get This Wrong
- Leaving code execution turned off. The number one reason people say it did not work. The skill installs fine and then cannot run anything, so you get a vague refusal instead of a report.
- Rewriting Claude text with Claude. You are handing the job to the thing you are trying to get away from.
- Skipping past the inspection report. That report is the only genuinely verifiable output in the whole process.
- Running a light rewrite and calling it done. A gentle pass that keeps your voice also leaves most of the original word choices sitting there. You do not get both.
- Forgetting to clean again afterwards. The rewriting model is an AI as well. Clean, rewrite, then clean again.
- Forgetting that images and documents carry their own marks. People clean the text and then publish the screenshot next to it with full content credentials and camera metadata attached.
Test it on something you have already published rather than on the thing you are about to send. You get to see what it finds without any pressure, and you will usually be surprised by how much metadata was riding along.
The Honest Part
The tool cannot prove it worked. The person who built it says so himself. Until vendors ship public detectors and keys, no tool can honestly certify that something fails the official check. Anthropic has announced a detection API but has not published how it scores, what its false positive rate is, or how much text it needs. The invisible character removal is verifiable, the statistical layer is not, and anyone telling you otherwise is guessing.
The rewrite costs you something real. Getting a second model to churn your word choices flattens tone and voice, and your writing comes back a bit more generic every time you run a heavy pass.
Watermarks and detectors are two different problems. Plenty of AI detectors work on writing style rather than any hidden signal, so text can come out completely clean of watermarks and still get flagged.
Out of scope entirely: pixel watermarks in images, audio and video marks, and C2PA soft binding, the kind that re-links to a remote record even after you strip the metadata.
Where This Is Genuinely Useful
- Pasting into a CMS or code editor. Clears the invisible characters that cause formatting bugs.
- Publishing images and PDFs. Strips EXIF, XMP and content credentials, which is basic privacy hygiene.
- Auditing your own site. Runs across a folder or sitemap and reports what your tools have quietly been leaving in your files.
- Cleaning your own drafts. Removes the small formatting tells before anything goes out under your name.
One last thought, because the developer put it in his own documentation too. If you are writing in a situation where being caught using AI would actually be a problem, that is usually telling you something about the situation rather than handing you a problem to engineer around. Use this on your own work, for your own reasons, and you will get real value out of it.
Your Next Step
Grab the SKILL.md off GitHub, upload it under Customize then Skills, turn on code execution, and run it on something you have already published. Seeing what it finds sitting in your own old work is the fastest way to understand what this thing actually does.
Paid subscribers can access a reverse-engineered campaign messaging hierarchy for GAP’s recent viral Hailey Bieber collaboration at the end of this post