Claude Watermark: How It Works, Detectors and Turnitin

On August 11, 2026, Anthropic announced that Claude would start embedding an invisible watermark in the text it writes. Within hours the loudest objection was not coming from students. It was coming from lawyers, academics and researchers who use Claude to copy-edit writing that is entirely their own, and who had just learned that their work would now carry a machine-generated marker.

The short version: the watermark is a statistical bias applied to Claude's word choices, not a hidden character inserted into your document. It survives copying, pasting, reformatting and conversion to plain text. It does not survive a rewrite, a translation or heavy editing. It applies to every Claude model released on or after August 2, 2026, worldwide, with no opt-out. And a positive detection tells you that Claude may have processed the text. It does not tell you who wrote it.

This guide covers what Anthropic actually built, the second marking system that got almost no coverage, what the mark does and does not prove, and what to do if writing of your own has been marked.

What did Anthropic actually announce?

The policy was published in Anthropic's help centre in an article titled How Claude marks AI-generated content. The essentials:

The driver is regulatory. Anthropic signed the EU AI Act's Article 50(2) Code of Practice on transparency for AI-generated content, which requires providers of generative systems to mark their output so it can be identified as machine-made. The obligation is European. Anthropic's decision to apply it to every user on earth, rather than to EU traffic only, is not.

When did Claude start watermarking?

Claude started watermarking text in August 2026. Anthropic announced the change on August 11, and it covers Claude models launched on or after August 2, 2026, the date set by the EU AI Act. The law gives models released before that date a transition period, and Anthropic has been adding the watermark to them one at a time.

In October, eight Claude models carried the text watermark. Anthropic's November list has twelve. The new ones are Claude Mythos 5, Opus 4.7 and Sonnet 4.6, which came out before August, and Claude Haiku 5.5, which Anthropic released on October 7, 2026.

Which Claude models write with a text watermark today?

Twelve Claude models write text with a watermark, according to Anthropic's support page in November 2026. They are Claude Fable 5.1, Fable 5, Mythos 5.1, Mythos 5, Opus 5.5, Opus 5, Opus 4.8, Opus 4.7, Sonnet 5.5, Sonnet 5, Sonnet 4.6 and Haiku 5.5. Four older models attach a Content Credential to the files they generate and don't embed a text watermark yet: Claude Opus 4.6, Opus 4.5, Sonnet 4.5 and Haiku 4.5.

Anthropic is adding the watermark model by model. It says it's working to bring it to models released before August 2, 2026, the date set by the EU AI Act's transition period. For Mythos 5, Opus 4.7 and Sonnet 4.6, the watermark is live on Anthropic's own products, and Amazon Bedrock will finish its rollout by November 10, 2026.

Sonnet 4.6 has one exception. Anthropic says its output may not reliably carry the watermark when temperature, top_p or top_k is set to a non-default value.

A missing watermark doesn't mean a person wrote the text. Text from Opus 4.5, for example, has no watermark yet. Anthropic also says heavy editing, paraphrasing, translation and very short passages can leave no detectable mark. Our guide to humanizing a Claude draft covers how to revise Claude-assisted academic text in your own voice.

How does the Claude watermark work?

This is the part almost every article got wrong in the first 48 hours, and getting it wrong leads people to solutions that cannot possibly work.

When a language model writes, it is not choosing the single correct next word. At most points in a sentence there are several continuations that are statistically near-equivalent: a handful of words any of which would read naturally. The watermark biases that choice according to a secret key held by Anthropic. Any individual choice looks unremarkable. Across a long enough passage, the accumulated pattern of choices forms a distribution that a detector holding the key can measure.

Three consequences follow, and they explain nearly everything about the mark's behaviour:

Nothing is added to your text. No zero-width characters, no invisible spaces, no metadata field, no formatting trick. The watermark is a property of which words were chosen, which is why Anthropic can accurately say it does not change the meaning, quality or readability of the output.

It travels with the words. Copy the text into an email, paste it into Word, convert it to plain text, change the file format. The words are unchanged, so the signature is unchanged.

It needs volume. A statistical measurement made over a token distribution requires enough tokens. Anthropic itself lists content "too short for reliable detection" as a reason a watermark may not be found.

The second system nobody covered: C2PA file metadata

The text watermark took the headlines, but Anthropic announced two mechanisms, not one.

When Claude generates a file rather than prose, specifically .svg, .png and .jpg, Anthropic attaches digitally signed provenance metadata following the C2PA standard from the Coalition for Content Provenance and Authenticity. This is a different technology solving a different half of the problem: an industry-backed format for recording an asset's origin and its modification history, cryptographically signed so tampering is detectable.

It is also considerably more fragile than the text mark. Anthropic acknowledges that C2PA metadata can be stripped by format conversion, by re-saving in a tool that does not support the standard, or simply by taking a screenshot. Metadata lives alongside the file; a statistical watermark lives inside the words. That difference in durability is why the text mark caused the argument and the file mark did not.

What removes the watermark, and what does not

The dividing line is mechanical rather than a question of how much effort you put in. Either an action leaves your actual words standing, or it reconstructs them.

The row that matters commercially is the third one. Most free tools currently marketed as AI watermark removers scan for zero-width Unicode characters and invisible spacing and delete whatever they find. That was a reasonable response to a genuinely different problem, and against Claude's watermark it accomplishes precisely nothing. Run one of those cleaners over Claude output and what comes back measures exactly as it did going in.

What does a positive detection actually prove?

Less than the word "detection" implies, and this deserves care because institutional policy is being written quickly right now.

A positive result signals that a passage may have been processed by Claude. Anthropic is explicit that a detected watermark does not establish that Claude authored the content, for the obvious reason that people use the model for editing, translation and summarizing work they wrote themselves. The measurement cannot distinguish a document Claude drafted from one Claude tidied up.

A negative result proves even less. Unmarked text may be human-written, may be from a model with no watermark at all, may be Claude output that was heavily edited, or may simply be too short to measure.

There is one more practical limitation worth knowing: general-purpose AI detectors cannot read this mark. Detection requires Anthropic's key, so it runs through Anthropic's own tooling, which had no release timeline at announcement. The detectors your institution already uses are not reading Claude's watermark today.

Is there a Claude watermark detector or checker?

There's no public Claude watermark detector yet. Anthropic's own Claude Watermark Detector checks text for the watermark, and it's in private preview. It's open to organizations that EU law names, such as regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations and EU civil society groups. Enterprises that have to verify watermarks for their own compliance can apply too. Anthropic takes requests through a form and says it plans to widen access over time.

Anthropic's free Claude Content Checker answers a different question. It checks whether an image, audio or video file has a Content Credential, the signed C2PA metadata Claude attaches to files it generates. Anthropic says the tool doesn't check text, because Claude marks text with a watermark in the writing itself.

How to check for a Claude watermark

1. For a file, upload it to the Claude Content Checker. A result that points to Claude means Claude may have made or processed the file.
2. For text, check whether your organization is one of the eligible groups, then apply through Anthropic's access form. Individuals can't check text for the watermark yet.
3. For a general estimate of AI writing, use an AI detector. These tools look at the text itself and can't read Claude's watermark, since that needs Anthropic's key.

Anthropic also says a detected watermark isn't fully conclusive. People use Claude to proofread, translate or summarize their own writing, and that text can carry the mark too. If a school or journal raises a watermark result about your work, our guide on appealing a false AI-detection flag covers what to say.

Can Turnitin detect the Claude watermark?

No. Turnitin can't read Claude's watermark, because detection needs Anthropic's secret key and runs through Anthropic's own detection API. Turnitin's AI writing detector still estimates AI writing from the text itself, the same way it did before August 2026. So Turnitin can still flag text that Claude wrote, based on its writing patterns. The same applies to GPTZero, Copyleaks, Originality.ai and other AI detectors.

Two details matter for students. Turnitin added detection aimed at humanizer and paraphraser output in August 2025, so a light rewording of a Claude draft can still be flagged. And educational organizations are one of the groups that can apply for Anthropic's detection API. Our post on whether Turnitin can detect humanized AI text covers Turnitin's newest checks.

Why the backlash came from editors, not from people hiding AI

The reaction was heavily negative, and the shape of it is the most commercially and ethically interesting part of the story.

The complaint that dominated was not "now I cannot pass off AI work as mine". It was "now my own writing is marked as AI". Attorney Peter Harrell put it directly: uploading his own writing for a copy edit means Claude will "watermark my (human written, AI-copy edited) text as AI, which seems ridiculous". Political scientist Maya Sen made the same point about the change making the model less useful for people like her. Radio host Erick Erickson: "the stuff I've written will be watermarked that Claude did the work."

They are describing a real and specific problem: false attribution. The watermark records that the model produced a sequence of tokens. It does not, and structurally cannot, record who produced the ideas, the argument, the research or the original draft. For a writer whose employer, publisher, journal or university reads a positive signal as settled proof of machine authorship, that gap is not academic.

Developers raised a parallel version of it. Code passes through formatters, linters and refactoring tools as a matter of routine, each of which rewrites whatever token choices remained. In a normal development workflow the mark degrades quickly, which makes it unreliable for the code-provenance use case some people immediately imagined for it.

Where this sits in the wider industry

Anthropic is not first, but the field is thinner than most coverage suggested.

Google's SynthID was the only text watermark deployed at scale by a major provider before Claude's, using the same underlying idea of biasing token probabilities during generation. It began with images in 2023 and expanded across text, audio and video, and it has been adopted beyond Google, including by OpenAI for images and voice output, and by ElevenLabs, Kakao and NVIDIA.

OpenAI embeds SynthID in ChatGPT images and has extended coverage to voice. Its own text watermark, textGrain, started on October 5, 2026, for eligible ChatGPT and Codex text in the European Union, and API customers can turn it on. Outside the EU, most ChatGPT text has no text watermark. So a document with no Claude watermark may have been written with a model that does not mark text at all. Our overview of AI watermarking at OpenAI, Google and Anthropic compares the three approaches.

What to do if your own writing has been marked

If the text is genuinely yours and the mark is a copy-editing artefact, the fix is to re-express the passage so the token sequence is rebuilt. Editing around the edges will not reliably do it, since most of your word choices survive a light pass.

For a single paragraph or section, our free Claude watermark remover does exactly that. It rebuilds up to 500 words at a time in fresh wording through a different model, while holding your facts, figures, dates, hedges and technical terminology fixed, and reproducing quotations and citations character for character. It is free with an account, and it works on the only mechanism that can work: regenerating the tokens rather than filtering the text.

For a complete manuscript, thesis chapter or report, the AI text humanizer is the better fit. A full humanization pass rewrites the whole document rather than patching it, moving machine-style prose into natural human style writing, and clearing a token-level watermark as a by-product of how it works. Both protect citations; the difference is scale and depth.

And if the underlying issue is that AI-assisted editing keeps putting your work under suspicion, our AI proofreader edits full documents with tracked changes you approve line by line, and does not watermark your text.

Frequently asked questions

Q: Does Claude watermark all of its text output?

Every Claude model released on or after August 2, 2026 embeds the watermark, across the Claude API, claude.ai, Claude Code, Claude Cowork, Claude Tag and Claude accessed through AWS, Google Cloud and Microsoft Foundry. Anthropic has said it is working to extend marking to older models during a transition period, so treating anything released before August as automatically exempt is unsafe. It applies worldwide and there is no opt-out on any plan.

Q: When did Claude start watermarking text?

In August 2026. Anthropic announced the watermark on August 11, 2026, for models launched on or after August 2, and it has added it to older models since then.

Q: Does Claude Sonnet 5.5 have a watermark?

Yes. Claude Sonnet 5.5 writes text with the watermark on every Claude surface, including the API and the cloud platforms, and it attaches a Content Credential to files it creates.

Q: Can I turn the Claude watermark off?

No. Anthropic has not provided a setting, a plan tier or an API parameter that disables it, and the policy applies to every user regardless of location. The marking implements a transparency commitment under the EU AI Act, which is why it is not offered as a user preference.

Q: If I copy and paste text from Claude, can it be detected?

Yes, the watermark stays in text you copy and paste, because it's part of the word choices. Only Anthropic's detection API can read it, and that's in private preview for eligible organizations. General AI detectors can also flag the text, based on its writing patterns.

Q: Do AI watermark remover tools that strip invisible characters work?

No, and this is the single most common misunderstanding about the announcement. Those tools search for zero-width Unicode characters and invisible spacing. Claude's watermark is a statistical bias in which words the model selected, so there is nothing of that kind present to remove. Text run through such a cleaner carries exactly the signature it started with. Only regenerating the tokens, which means rewriting, affects a sampling-bias watermark.

Q: Will the watermark show up in Turnitin or GPTZero?

Not today. Reading the mark requires the secret key used to embed it, so detection runs through Anthropic's own tooling rather than through third-party AI detectors. Anthropic said it plans to make verification available but gave no timeline at announcement. Note that this is independent of whether those detectors flag your text for other reasons, which they may do regardless of any watermark.

Q: Does the watermark prove that Claude wrote something?

No. It indicates that the text may have been processed by Claude. Anthropic states plainly that a detected watermark does not confirm Claude authored the content, because the model is widely used for editing, translation and summarizing text that people wrote themselves. It cannot separate a draft the model generated from a paragraph it copy-edited, and it says nothing about what proportion of a document is machine-written.

Q: Does paraphrasing remove the Claude watermark?

Heavy paraphrasing does, because it rebuilds the sequence of words rather than adjusting it. Light paraphrasing is unreliable: if most of the original word choices survive, so does enough of the signal to measure. The same logic applies to translation, which removes the mark completely, and to light proofreading, which generally does not.

Q: What about images and files Claude generates?

Those use a different system. Files in supported formats, .svg, .png and .jpg, receive digitally signed provenance metadata built on the C2PA standard rather than a statistical watermark. C2PA metadata is easier to lose: Anthropic notes it can be stripped by format conversion, by re-saving in a tool that does not support the standard, or by taking a screenshot.

Q: Can I request access to Anthropic's watermark detector?

You can request access if your organization is in one of Anthropic's eligible groups. These are regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, EU civil society groups and enterprises with their own compliance duties under the EU AI Act. Anthropic takes requests through a form linked from its watermarking support article and plans to widen access over time.

Q: Does the free Claude Content Checker tell me if my text has a watermark?

No, the Claude Content Checker only checks files, such as images, audio and video, for a Content Credential. Anthropic says on the tool's page that it doesn't check text, because Claude marks text with a watermark in the writing itself. Checking text needs the separate detector, which is in private preview.

Q: Does Claude Code or the Claude API watermark text the same way claude.ai does?

Yes, Anthropic applies the text watermark at the model level, so it's present wherever a supported model runs. That includes the Claude API, Claude Code, Claude Cowork and Claude Tag as well as the Claude apps. The same models through AWS, Google Cloud and Microsoft Foundry carry the watermark too.

Q: Which Claude models don't have a text watermark yet?

Four Claude models don't have a text watermark yet: Claude Opus 4.6, Opus 4.5, Sonnet 4.5 and Haiku 4.5. Each of them still attaches a Content Credential to the files it generates. Anthropic says it's adding watermarks to models released before August 2, 2026, so the list may get shorter.

Academic AI Humanizer

Rewrites AI-assisted drafts in your own voice, keeping citations, figures and technical terms in place.