What watermark removers actually remove
Published ; updated
No public tool can currently certify removal of Claude's undisclosed text watermark. A program can verify that it removed selected Unicode characters or an embedded C2PA manifest. Rewriting may alter a statistical pattern. The operations differ; none proves that an official Claude detector would return a negative result.
Four different carriers share one name
The term "watermark" covers several distinct technical carriers. A tool that handles one of them may have no effect on another.
Scroll horizontally to see all columns
| Carrier | What can be changed | What a successful operation establishes |
|---|---|---|
| Selected Unicode characters | Remove or replace exact code points | Those selected characters are absent from the output |
| Embedded C2PA manifest | Remove the manifest store from a supported file | That supported embedded store is absent from the output |
| Statistical token-choice pattern | Reword some or much of the passage | Word choices changed; detector impact is unknown without the matching detector |
| Pixel or soft-binding channel | Re-encode or alter image content | Nothing conclusive unless the matching resolver or detector is tested |
Unusual Unicode is not evidence of AI generation. Joiners shape Persian, Arabic, Urdu, Indic text and emoji. Direction controls make bidirectional text readable. Variation selectors can determine whether a symbol appears as text or emoji. Spaces and combining marks can also be meaningful. Removing them by category can damage ordinary human writing while leaving a statistical watermark untouched.
C2PA metadata works differently. A standard C2PA manifest contains signed assertions and a hard binding to an asset. The C2PA specification expressly allows its metadata to be removed. The specification also defines soft bindings that can reconnect an asset to a remotely held manifest after embedded metadata has gone. Removing an embedded manifest does not prove that every provenance channel has disappeared.
Current cleaners
Dated observation, checked 12 August 2026. The public tools we reviewed do not include a detector compatible with Anthropic's undisclosed text mark. They clean observable structures or rewrite prose. Anthropic has not published the detector needed to verify the result.
demark at the reviewed revision has good output-safety discipline. Inspection does not write. Ordinary cleaning creates a new file. In-place cleaning is opt-in and makes a backup unless the user disables it. The tool re-inspects its output and distinguishes verified structural cleaning from unsupported statistical and pixel-domain claims.
Its default cleaning scope is broader than Declawd's. According to its documentation, an ordinary clean removes joiners, bidirectional controls, variation selectors and unusual spaces, and removes broad image metadata families rather than only an embedded C2PA store. Those structures can carry language, presentation, attribution or accessibility meaning. Its PolyForm Noncommercial licence is also a use constraint: we can study and cite the published design, but Declawd does not copy, depend on or execute it for a commercially published benchmark without permission or legal clearance.
watermarks-remover v0.1.0 similarly distinguishes deterministic Unicode and metadata cleaning from a best-effort rewriting layer. Its own documentation says that no tool can certify failure of a vendor check until the vendor provides a detector and the required secret material.
Declawd's design choices
Declawd follows an inspect-first workflow, writes to a separate file and checks the output. Its report names every untested channel, and its cleaning scope is narrower.
Text inspection names each code point and position. Nothing is selected by default. The user chooses an exact character or a narrowly named class, sees the proposed action and keeps the original. The public Declawd v0.1.1 CLI removes only a supported embedded C2PA store from PNG or JPEG while preserving image data and unrelated metadata. The CLI does not offer blanket Unicode normalisation, automatic homoglyph folding, broad metadata stripping or an in-place mode.
Declawd reports only what it checked: selected structures were removed; no supported embedded carrier remains; statistical, soft-binding and pixel-level marks were not tested. It never says "Claude watermark removed".
Legitimate use and misrepresentation
People have legitimate reasons to inspect and alter files they own. Hidden characters can break search, source control and downstream systems. Embedded provenance can expose a workflow or tool choice a person did not intend to publish. Running the cleaner shows those limits directly.
Trouble starts when a cleaner promises more than it can measure. A one-click service that rewrites arbitrary prose and announces it "human" would turn an explanation into an evasion claim. Declawd publishes a controlled attack against its own disclosed watermark, a user-directed word editor and explicit structural cleaning. Declawd does not suggest synonyms, call another model or claim to defeat a vendor detector.
Use is limited to content you own or are authorised to modify. Finding or removing a listed character does not show that AI was involved, and a cleaned file does not establish authorship.
Evidence still needed for Claude
Anthropic says it will publish technical documentation and enable third-party detection. A compatible detector, supported model list and error-rate evidence would make a real before-and-after test possible. The public tools reviewed on 12 August 2026 could not test whether Claude's mark had been removed.
Try the educational cleaner, or read the controlled experiment.