How Claude's invisible text watermark works
Anthropic now watermarks Claude's text. What gets embedded, why retyping cannot remove it, where the signal fades, and what the EU rules demand.
There is nothing in a watermarked Claude answer you could point at. No label, no hidden character, no extra token, no difference in what appears on your screen. The whole mechanism, set out by Anthropic on 14 August 2026, sits in one small change to how the model picks its next word, and nearly every practical question people have about it (can I retype it away, does it catch code, will my university see it) falls out of that single change.
A different source of randomness
A language model writes one word at a time. At each step it has a shortlist of plausible next words, and quite often two or three of them are equally good. Anthropic's own example is the sentence "The weather today was cold and". "Overcast" and "grey" both work, the sentence means the same thing either way, and the model settles the tie with a random number.
Watermarking changes where that random number comes from. Instead of an arbitrary generator, the model uses a secret key plus the handful of words preceding the choice. The picks still look random, and a reader cannot tell them apart from the unwatermarked version, but anyone holding the key can walk a passage and ask whether this sequence of coin flips looks like the ones that key would produce. In Anthropic's words, "the words that Claude picks are still random, but now, one can check the sequence of words and see if it's consistent with the choices Claude would make if it was using the key."
The method is a version of SynthID-Text, published by Google DeepMind in Nature in 2024, descended from a 2022 proposal by Scott Aaronson. Anthropic heads off one misconception: the watermark does not push Claude toward strange vocabulary. It will not start reaching for "nubilous" when it means overcast. It only breaks ties between candidates the model was already willing to use, which is why Anthropic reports no impact on content, creativity or readability in its own testing, a negligible effect on speed, and no extra tokens.
Why retyping does nothing
Because the signal lives in which words were chosen and in what order, it survives every operation that preserves those words. Copying into a plain text editor strips the formatting and leaves the watermark untouched. Retyping by hand reproduces the passage letter for letter, which reproduces the signal exactly. Changing the font, exporting to PDF, running it through a converter: all of it moves characters around without altering one word choice, so the pattern survives.
That surprises people who picture a watermark as a layer sitting on top of the text, the way a bank note carries one. There is no surface here to scrape. The only thing that touches the signal is replacing the words themselves, which is what Anthropic says directly when asked whether editing defeats it:
Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will. In the latter case, of course, it's arguable whether the text can any longer be described as AI-generated.
That second sentence is the honest part. Heavy rewriting weakens the signal as a plain consequence of the mechanism: the fewer of Claude's word choices remain, the less there is to measure. Rewrite a draft so thoroughly that none of the original wording survives and you have written the thing yourself, which is the outcome the rules were aiming at.
Places the mark barely reaches
The watermark needs choices, so it fades wherever choice disappears. Once a sentence reaches "Isaac Newton's most famous work was called Principia", the next word has exactly one correct value, and there is nothing for the mark to ride on. Constrained factual writing is therefore sparsely marked. So is anything short, because detection is statistical and a few sentences may not carry enough decisions to reach confidence; confidence rises with length.
Proofreading is the biggest hole, and Anthropic says so plainly. Hand Claude your own paragraph and ask it to fix grammar and punctuation, and almost every word coming back is yours. The mark can only attach to the handful of corrections, often too few to register.
Code behaves the same way for the same reason. Exactness is usually required, a different identifier breaks the program, so the nudge goes unapplied and executable code carries less watermarking than prose. Comments inside code can be marked, since the wording there is arbitrary, though that has a negligible effect on the code itself. Translations sit at the opposite end and are fully watermarked, because every word in the output was chosen by the model.
Files use a separate mechanism. A .png, .jpg or .svg from Claude carries a C2PA content credential, a signed note in the file's metadata saying Claude made or processed it. Nothing inside the image changes, and anything that rewrites the file can strip that metadata.
Consumer app, API, or both
Here is the question the announcement does not answer cleanly, and it matters to anyone who reaches Claude through another product. Anthropic scopes the change at the model layer rather than at any one product surface: "Future Claude models will generate text that contains a watermark." Nowhere on the page is there a sentence limiting it to claude.ai, and nowhere is there one confirming it for API traffic in those words.
Several details point at the model layer and away from the consumer app alone. Anthropic says the watermark "carries no identifying information and can't be traced to a specific person, organization, or chat", which is an odd reassurance to offer if only consumer chats were involved. It says the model is "the same price to serve and use", which is pricing language aimed at developers. And it opens detection API access to "enterprises who are similarly obligated to verify watermarking for their own compliance with the Act", a sentence that only makes sense if business output carries the mark too.
Read together, that reads like a model-level change covering API output as well. Anthropic has not stated it in those terms, so the safe working assumption is that text from Claude may carry the watermark wherever you obtained it. Reaching it through a third-party app is no reason to think otherwise. MultiChats calls Claude through Anthropic's API, as most third-party apps do, and we have no basis for telling you our Claude output behaves differently from anyone else's.
The rule that pushed this
Anthropic is explicit about the driver: it is complying with the EU AI Act. Article 50(2) requires providers of AI systems that generate synthetic content to "ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated", with a proportionality caveat about what is technically feasible and the generally acknowledged state of the art. Those transparency obligations apply from 2 August 2026. Anthropic also signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026; the European Commission's announcement of 31 July counts about 190 signatories and names Anthropic among them.
Two limits are worth holding onto. The marking duty in 50(2) falls on the provider of the system, which means Anthropic and its peers. Using one puts no marking obligation on you. A separate provision, 50(4), asks deployers who publish AI-generated text with the purpose of informing the public on matters of public interest to disclose that, and even that carves out content which has been through human review or editorial control where a person or company holds editorial responsibility. Nothing in the Act asks a student or an employee to label a draft.
Older models get a transition period. Anthropic says the law allows one for models launched before 2 August 2026, and that watermarking for those will arrive over the coming months, so coverage was partial at the September update.
What it changes for you
Access was limited at the September update. The detection API is in private preview, and as of the page's 1 September 2026 update it reaches regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations, EU civil society groups and enterprises the Act obliges. Your lecturer cannot paste an essay into a public Anthropic checker. Institutions that police AI use still lean on commercial detectors, which work on a different basis: stylistic tells, a favourite contrastive sentence shape, an unaccountable fondness for the word "quietly". Those tools guess. The watermark measures.
Even so, what the watermark proves is narrow. It reports a likelihood that Claude was involved somewhere in the text. It cannot separate "Claude wrote this" from "Claude heavily edited this", and it is blind to other models, which carry their own keys or none at all. It also carries nothing about you, so a positive result points at a model and never at an account.
That distinction matters when interpreting a result. Wholesale generated text becomes checkable. Genuine collaboration, where you draft and a model sharpens, was never going to produce a clean verdict, and now it produces a weak signal no fair reader should treat as one. If you use Claude at work or in coursework, be clear about your use: say what you used it for.