How Does Claude's Text Watermark Work?

Quick answer

• Claude stamps generated text with an invisible statistical watermark based on Google DeepMind's SynthID-Text. A secret key plus the previous words change only the source of the randomness used to pick among equally good words. Nothing is inserted. It is not hidden characters.
• Today only Fable 5.1 and Mythos 5.1 carry the mark. Older models from before 2 August 2026 do not, and Anthropic has not named a rollout date.
• Detection is not open to the public. Since 1 September 2026 a detection API has been in private preview for eligible organisations under EU law. Regular people, teachers and employers have no way to test a sample.
• Light edits such as typos generally leave the mark. Rewriting that regenerates the wording weakens it most. No removal tool can be verified, because there is no public detector to test against.
• For confidential work this is a data-governance question, not a setting you can switch off. Treat anything from a marked model as marked.
• Try Elephas for Mac to keep private data local. Elephas is a privacy friendly AI knowledge assistant for Mac that redacts sensitive data locally before it reaches a cloud model. Elephas starts at $19/month and there is a free plan.

What does the watermark actually change?

Claude's watermark does not make Claude prefer any particular word or push Claude toward odd vocabulary. Anthropic uses "nubilous", an obscure synonym for overcast, as an example of a word the mark would not make Claude reach for. Anthropic says it "only changes the source of the randomness used to pick among words".

A model writes one word at a time, picking from a list of candidates, and often several are equally good. After "the weather today was cold and", either "overcast" or "grey" works. The choice between them normally comes down to a random number. The watermark replaces that random number.

Instead of an arbitrary source of randomness, Claude uses a secret key plus the preceding words to settle which of the equally good options it takes. Anyone holding the key can later check whether a passage matches the choices that key would have produced, and put a probability on Claude's involvement.

The method is a version of SynthID-Text, published by Google DeepMind in Nature, as the paper documented. Anthropic has not published its own implementation, so nobody outside the company can confirm the deployed version matches the published method. It is not hidden characters or zero-width Unicode, the most common mistake people make.

Does the watermark hurt Claude's writing?

The published evidence says no. In DeepMind's published testing across live Gemini traffic, the study found that marked and unmarked responses showed no statistically significant difference in user ratings.

Anthropic adds a second data point. In a controlled study, human raters comparing marked and unmarked answers side by side saw no difference in quality.

It produces no extra tokens, so it costs the same to run and has a negligible effect on speed. It carries no identifying information and cannot be traced to a person, an organisation or a chat.

Which Claude models are watermarked right now?

Models launched before 2 August 2026 are not marked yet. Anthropic has described a transition period and says it is working to add marking support for those models as well.

Anthropic has given no date. Its own wording, in the support article, is: "Claude models launched on or after August 2, 2026 support marking at launch. Models currently supported include Fable 5.1 and Mythos 5.1."

Can anyone actually detect it?

There is still no public text detector. Anthropic updated its watermark explainer on 1 September 2026 to add detection API details.

That API is in private preview. It is open to eligible organisations under EU law, such as regulators, law enforcement, media, fact-checkers, researchers, educational organisations and EU civil society groups.

An ordinary person, teacher, or employer cannot check text.

The free file checker checks images, audio, and video for C2PA Content Credentials. It does not check text. Images get C2PA metadata. Text gets the SynthID-Text watermark. Those are two different things.

Why proofreading mostly escapes it

The mark attaches only to words Claude chose. It lives in the sequence of those words. When a person wrote the document and Claude only fixed typos or tightened a sentence, almost every line is still that person's wording. There is very little to detect.

Translation is the exception that proves the rule. A translation is fully marked, because every word in it was chosen by Claude.

Factual writing carries less of it. After "Isaac Newton's most famous work was called Principia", only one next word is right, so the mark has nothing to work with.

Does the watermark apply to code?

Partly. Exact outputs get no mark, because there is no equally good alternative to choose between.

Comments and other free-form text inside code can still carry it.

Nothing is inserted into the file, so there are no stray characters for a compiler to trip over.

Anthropic has not published tests showing how well the mark survives refactoring, linting or commits.

What a Claude watermark can and cannot prove

A Claude watermark can signal that Claude was likely involved in the wording. It cannot identify who used Claude, which account, or which chat. It cannot detect another company's AI, which would use a different key or a different method entirely.

Detection is a probability, not a verdict. Comparable tools return an explicit "uncertain" alongside yes and no. Confidence rises with length. Short passages may never carry enough signal to test.

Research on this family of watermarks found that after heavy human paraphrasing, detection needed around 800 tokens, roughly 600 words. The chief technology officer of GPTZero has said free paraphrasing tools already defeat Google's equivalent system. Anthropic has not published its false-positive or false-negative rates.

A watermark can show that Claude wrote a passage, but it cannot prove your files stayed private or who wrote a file. Check if it is safe for confidential files before you paste anything into a cloud AI tool. This workplace watermark guide explains what it actually shows when confidential documents are involved.

What to do if you are accused of using AI

One university's guidance refuses to accept any AI detector as the only basis for a misconduct case. It reports that a third of recent cases based on detector output alone ended with no finding against the student. Detection tools have a documented record of misfiring on people who write in English as a second language.

The best known professional sanction over AI use, a $5,000 penalty against lawyers in New York, was for citing cases that did not exist, not for using AI.

There is still no verified instance of anyone being penalised because a statistical watermark was detected. The consistent rule across professions is disclose and verify, not avoid detection.

• Ask what the accusation is actually based on. Most tools are style guessers, not watermark readers.
• Almost nobody can read this watermark. Anthropic's detection API is a private preview for eligible organisations, so a claim that "the watermark says so" needs evidence of how it was read.
• Keep version history, drafts and edit trails. Those records show how the work was written over time.

If someone is accused of using AI, professional rules put the duty on that person to disclose where appropriate and verify output, which is a separate question from confidentiality.

The law behind it

The EU AI Act Article 50(2) requires AI-generated content to be marked in a machine-readable format and detectable as artificially generated. The Commission FAQ says this took effect on 2 August 2026. Anthropic applies the mark worldwide, not only in the EU.

There is a limited grace period. Systems already on the market before 2 August 2026 must comply by 2 December 2026. That is the deadline for Claude's older, unmarked models.

Content generated before 2 August 2026 does not need to be labelled retroactively. Breaching Article 50 obligations can bring fines up to 15 million euros or 3% of total worldwide turnover.

Article 50(4) is a separate duty, and it lands on the people using the tool, not the model maker. It requires deployers to clearly label AI-generated text published to inform the public on matters of public interest. Human review or editorial control exempts text from that labelling duty.

Where other AI companies stand

Google marks text in its Gemini apps and also marks generated images, video and audio. OpenAI is the more revealing case. It built a text watermarking tool years ago and chose not to release it, citing false positives and the fear that users would move to competitors that did not mark. It does mark images.

Meta and Microsoft have documented image marking with no public evidence of text watermarking. The image tool from Grok applies a visible mark with no removal setting. No public documentation establishes text watermarking at Meta, Microsoft, Mistral, xAI, DeepSeek or Qwen.

What is publicly known about Grok and those companies is image marking, not text. Open-weight models that run locally carry no automatic mark, because this marking happens during generation, not in the weights.

Anthropic is applying the mark worldwide because, in its words, it does not yet have "a durable way to scope it by region". It says it will keep evaluating alternatives. Google's approach is different, and this Claude Gemini comparison shows how Gemini's SynthID differs from Claude's mark.

Cancellations and Claudefishing

When the mark was announced, some users said they were canceling subscriptions, citing the new watermark. A term for undisclosed AI use, "Claudefishing", started circulating in the same week. Anthropic said it had not seen an uptick in cancellations.

Other AI companies do not use the same watermark rules, so if you are comparing the two main assistants, a ChatGPT versus Claude comparison will show how the tools differ beyond hidden marks.

If the watermark is why people cancel, this Claude alternatives list covers the tools knowledge workers move to instead.

Keeping confidential work private when you use AI

If watermarking, or any policy change, is a dealbreaker, Elephas is what you move to. You do not lose model access. Elephas gives the main frontier models in one Mac app: ChatGPT, Claude, Gemini, Grok, and Perplexity. Leaving one vendor does not cost capability. Elephas pairs with those cloud models; it does not replace them.

For the most sensitive work, run the built-in local LLM models entirely on the Mac so nothing leaves the device.

Elephas is a private AI knowledge assistant for Mac that redacts sensitive data before it reaches cloud models. Its automatic PII redaction strips names, emails, phone numbers and identifiers locally before any prompt reaches a cloud model.

The cloud model only ever sees sanitized text. The redacted fields are reassembled locally when the answer returns, so identifying information never leaves the device.

Smart Redaction is on every plan including Free. Your data never trains AI models, never sits on a vendor's server, and never passes through a third-party reviewer's screen.

Elephas is not a watermark remover and does not make any model's output undetectable. Switching changes which model you use and what data reaches it, and does not strip a mark from text already generated. It has a free plan and starts at $19/month, and is Mac, iPhone and iPad only with no Windows build.

Keeping confidential work private still comes down to what you paste where, which is a separate question from whether a mark exists.

Frequently asked questions about the Claude watermark

Does Claude watermark its text?

Yes, but only on its newest models. Fable 5.1 and Mythos 5.1 carry it today, and models launched before 2 August 2026 do not yet. The mark is an invisible statistical watermark, a tilt in which word the model picks as it writes. The method is based on Google DeepMind's SynthID-Text.

Nothing is inserted into the text, and the mark is not zero-width Unicode, hidden characters, or extra tokens.

How does the Claude watermark work?

The watermark works by tilting which word Claude picks next, using a secret key plus the words that came before. Anthropic says this is based on Google DeepMind's SynthID-Text. Nothing extra is added to the output. Anthropic has not published the full spec of the version it actually runs.

Which Claude models are watermarked?

Fable 5.1 and Mythos 5.1 are the watermarked Claude models today. Anthropic's support article says models launched on or after 2 August 2026 support marking at launch. Models launched before that date are not yet marked.

When will the rest of Claude's models be marked?

Anthropic has not given its own date. It says there is a transition period and it is working to add marking for models launched before 2 August 2026. EU rules say systems that were on the market before 2 August 2026 must comply by 2 December 2026.

Is there a Claude watermark detection API?

Yes, there is a detection API in private preview. The watermark explainer says it is available to eligible organisations required under EU law, such as regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations, and EU civil society groups. The public cannot use it.

Does the watermark apply to code?

Yes, the watermark can apply to code in comments and free-form wording. Exact required syntax carries little or no mark, because there is no equally good alternative to pick between. Anthropic has not published tests showing how well it survives refactoring, linting, or commits.

Will editing or paraphrasing remove the watermark?

Light edits such as typos generally leave the watermark in place. Rewriting that creates new wording weakens it most.

This cannot be checked, because there is no public detector to test against. BleepingComputer found that almost none of the tools claiming to strip the mark can prove they work. Editing and paraphrasing rarely wipe the signal, so this watermark removal guide explains what actually happens and why switching tools is usually the honest answer.

Can I turn the watermark off?

No, you cannot turn the watermark off. There is no opt-out and no regional carve-out. The mark applies everywhere you use Claude, including Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag, worldwide.

Sources

• Anthropic: How Claude's text watermarking works (14 August 2026)
• Anthropic: How Claude marks AI-generated content
• EU AI Act, Article 50: Transparency obligations
• Nature: Scalable watermarking for identifying large language model outputs (SynthID-Text)
• Kirchenbauer et al.: On the Reliability of Watermarks for Large Language Models
• Washington State University: Detecting and reporting AI misconduct
• City A.M.: Claude to watermark AI slop, including edited human writing
• TechCrunch: Anthropic says it will watermark text generated by its AI models