AI Watermark Removers: What They Remove and What Survives

An AI watermark remover does not remove AI watermarks. It removes hidden characters and file metadata, which are the two things that were never hard to remove, and it leaves the mark that was woven into the pixels while the image was generated, or into the word choices while the sentence was written.

Take the mark most people are currently trying to delete. Anthropic says Claude's text carries SynthID-Text, a pattern in which words the model chose, and that only Anthropic can read it. There is no character in your paragraph to find, no field to blank, and no public tool that reads the mark, which means there is also no way to confirm you removed it. Not one tool in this post touches it. Two of them say so themselves, in documentation their own customers never reach.

Our own detector is a text classifier, not a character scanner. It is a Core ML model that runs on-device, on the Apple Neural Engine on iPhone and iPad and on the Neural Engine or GPU on Mac, and the weights scored by the benchmark are the weights that ship in the app. It caught 99.5% of AI text at a 5% false-positive rate on RAID, a public benchmark we do not run, whose test set already contains the homoglyph and whitespace attacks these cleaners perform. The edit they sell you is a test case inside the benchmark it is supposed to defeat.

We read three of these tools on their own pages, then ran their promise against our own detector. Let me explain.

• Does the Most Starred Remover Remove Watermarks?
• What Do AI Watermark Removers Actually Remove?
• Why Does "AI Watermark" Mean Three Different Things?
• What Does Claudewatermark.com Get Wrong?
• Why Stripping Metadata Was Never the Hard Part
• What Survives a Cleanup?
• Should You Use a Cleanup Tool at All?
• FAQ
• Check What Survived

Does the Most Starred Remover Remove Watermarks?

No, and the timing tells you what it was for. Anthropic announced Claude's watermark on 11 August 2026. A repository called watermarks-remover appeared the same day and shipped its first release that evening. Within a week it had 14,194 stars.

It deleted metadata. The mark that had put those people in the search box, announced that morning, was never in reach.

A repository name is an advertisement, and this one advertised the exact capability the news had just created demand for. Here is the author, a day later, explaining that the product does not do it:

The repo explicitly says that it only removes the metadata from images and supported file formats for now. Removing steganography marks from various vendors MAY come later, but it is not available right now.

View on X

Saying it out loud is more than most of this category manages, and it changes nothing about who read what. A correction buried in a reply reaches a few thousand people. A repository name sitting on top of every search for this subject reaches everyone else, and the name has not changed.

A later release added an optional external pixel-removal backend, so that quote describes 12 August rather than today. The answer holds, and the project's own documentation is why. From the version archived on 17 August 2026:

Until vendors ship public detectors and keys, no tool can honestly certify "this fails the official check."

And from the section on what remains after a clean:

This tool reports verifiable removals (Unicode counts, metadata actions) and best-effort Layer B rewrites. It cannot certify that vendor detectors will fail.

The same file calls its pixel path "a regenerating remover, not a guarantee," names Google's own SynthID check "the final authority," and marks pixel image marks "Out of scope" for Claude and OpenAI. The most capable tool in the category cannot do the thing the category is named after. Everything above that line in the README is a metadata utility wearing a headline.

That is the play. Put the name up the day the news breaks, take the traffic, and correct the record several screens below where anyone stops reading. The two websites further down run the same play with far worse manners, and to see why it works at all, start with the word itself.

What Do AI Watermark Removers Actually Remove?

AI watermark removers remove hidden Unicode characters and file metadata. Zero-width spaces come out of text. C2PA, IPTC, EXIF, and XMP records come out of the image and document formats the tool supports. Watermarks carried in the pixels, and statistical marks carried in word choice, sit in a channel that stripping does not reach.

First, the hidden characters, which is what nearly everybody means by the word. Zero-width spaces, zero-width joiners, word joiners, and letters borrowed from Cyrillic or Greek that look exactly like Latin ones. They sit between your visible letters and break software that never expected them. Any editor with find and replace clears them once you know what to search for.

Second, the metadata: C2PA Content Credentials, IPTC fields, EXIF, XMP. All of it rides beside the picture instead of inside it, so a tool that understands the container can detach the whole block cleanly. The competent removers do exactly this, and they are right to advertise it.

Third, and this is the one that matters, the mark that is part of the content. Google DeepMind's SynthID is woven into the image data while the image is generated. Statistical text marks such as SynthID-Text live in which word a model picked when several would have worked. Tooling that works beautifully on the first two classes has nothing to grab here, and no tool in this category can honestly promise the mark is gone.

Why Does "AI Watermark" Mean Three Different Things?

The confusion starts before any tool runs. Many sites define an AI watermark as invisible Unicode and stop, which quietly promotes one narrow class into the whole subject.

Watermarkdetector.com, archived on 22 July 2026, shows the pattern. Its explainer says AI watermarks "are invisible markers embedded in AI-generated text to identify its artificial origin," then lists "zero-width spaces (U+200B), zero-width non-joiners (U+200C), word joiners (U+2060), and various spacing patterns." Every word of that is true about one channel. As a definition of the category it is short by two.

The definition is not a footnote, because the product is named after it. A page called a watermark detector, calling itself a "Professional QA Tool", searches one channel out of three and then reports back. By its own description it looks for hidden characters, so text carrying a statistical mark comes back clean, and so does text that was simply written by a model and never marked at all. That is the correct answer to the question the code asked and the wrong answer to the question you arrived with. The tool is honest about its own limits and never promises anyone will go undetected. The name promises the category, the code covers a third of it, and the reader keeps the number the name gave them.

What Does Claudewatermark.com Get Wrong?

Claudewatermark.com deletes zero-width characters and normalizes em dashes, and that machinery works. The copy around it does not survive a careful read: the FAQ credits Claude's watermark to OpenAI, the body text misspells both Anthropic and Claude, and the cleaned text is handed to a third-party "humanizer" under a promise nobody can keep.

Here is the site's own answer to its first FAQ question, "What is a Claude Watermark?", archived on 12 August 2026:

A Claude Watermark is a hidden pattern of characters or subtle text modifications that OpenAI may embed in ChatGPT-generated content.

A page named for Claude defines its subject as something OpenAI might do to ChatGPT output, in the first answer it gives anyone. Wrong company, wrong product. Even the borrowed half is misplaced, because OpenAI documents that mechanism for its image generation, not for hidden characters in ChatGPT prose.

The body copy reads like a find and replace that missed twice. One paragraph says "AI systems like Claude Anthrotopic may insert invisible characters." A later section opens with "Cluade and other AI systems often generate text with various types of em dashes."

Typos we can forgive. The next part we cannot. After the cleaning step, the page offers to "make it 100% human-written and undetectable by AI detection systems!" and links to gpthumanizer.io, which appears four times in the archived page as an outbound destination.

That destination is a rewriter with a subscription attached. Its homepage sells a "99.8% Bypass Rate", a number it awards itself, and it stops you at 125 words until you upgrade to a Pro or Team plan. Watch what the handoff actually does: a tool that deletes invisible characters passes you to a tool that rewrites your sentences, and both steps get sold under the same word. Deleting invisible characters cannot make text human-written, because the words were already written by whoever wrote them, and not one of those words was ever a zero-width space. Rewriting does change the words, which is a different operation with different costs, and no rewrite comes with a guarantee either.

If you want that rewrite, you are probably already paying for something that does it. Claude, Codex, or whichever coding agent you already subscribe to will rewrite a paragraph on request, and we publish a free MIT-licensed skill, the agentic humanizer, that gives them a structured five-pass workflow instead of a vague instruction. Our guide to running it covers the install. No second subscription, no 125-word wall. What it will not hand you is a bypass percentage, because nobody can honestly print one, and that includes us.

Why Stripping Metadata Was Never the Hard Part

Removing metadata has been solved for twenty years, which rarely makes it into the pitch. ExifTool stripped EXIF, XMP, and IPTC from the command line long before anyone generated an image from a prompt, and c2patool from the Content Authenticity Initiative reads and writes C2PA manifests today. Emptying a field never needed a new product category. The watermarks-remover README concedes this by calling both tools when they are installed, c2patool for C2PA manifests and exiftool for leftover metadata in PDFs.

Metadata is a wrapper. It is readable, writable, and detachable by design, and that is why C2PA credentials are cryptographically signed: the signature makes a credential that is present mean something. The design never covered absence and never could.

Even this easy class gets it wrong in one way worth knowing. ExifTool writes PDFs incrementally, so a plain exiftool -all= frees the info object while, in the README's own words, "the original metadata bytes stay in the file verbatim." The command exits zero, the viewer shows a clean document, and the file gets bigger, which is how you catch it. Our post on removing AI metadata from images walks through the same trap on the image side.

What Survives a Cleanup?

Pixel watermarks and statistical text marks survive an ordinary cleanup, because neither one sits where a cleanup tool operates. SynthID is embedded in the image data itself, which is why it holds through screenshots, re-encoding, and metadata stripping. Text classifiers survive for a duller reason: they never needed a mark at all.

Slop or Not is the only AI image detector that reads Google DeepMind's SynthID watermark from both Google and OpenAI images. Google's own detector checks only Google's images, and OpenAI's checks only OpenAI's. Our results deep-link to both, so you can check our work instead of taking our word. The photo check also verifies C2PA credentials against a bundled trust list rather than just parsing them, so a forged credential fails, and it reads IPTC records that name generators such as Microsoft Designer and Apple's Image Playground.

Claude is not on the image SynthID list and no honest copy should put it there. Anthropic says supported Claude image files carry C2PA Content Credentials, and its text mark is a separate SynthID-Text mechanism that only Anthropic can read. Our classifier does not need it. Our post on the Claude watermark works through what each signal can and cannot settle.

On the text side the removal premise collapses completely, so we ran it instead of asserting it. We took a paragraph of AI-written text, added six invisible characters and two Cyrillic homoglyphs, and checked it: flagged as AI at 99.99% confidence. Then we ran that text through our own Text Cleanup, which removed all six invisible characters and swapped both homoglyphs back, and checked the clean version: still 99.99%, and the score moved slightly up rather than down. Eight edits, and nothing the detector reads was touched, because nothing the detector reads was ever hidden.

Which leaves an uncomfortable summary for anyone selling removal. A watermark only ever catches the person who left it in place. Take it out and the words still read the way whoever wrote them wrote them, the classifier keeps working, and the clean file proves exactly one thing: this copy carries no readable credential.

Should You Use a Cleanup Tool at All?

Yes, for the job cleanup actually does, and we ship one, so we are not neutral here. This is the part the whole post owes these tools. One zero-width space can break a CMS import or a diff while nothing on the screen tells you why, and hidden characters also confuse screen readers and defeat search inside a document. Removing them is real maintenance with a real payoff, and the good removers do it well. What the work needs is a tool that describes itself accurately, and accuracy costs any such tool its most exciting sentence.

Slop or Not's Text Cleanup is deliberately boring. It is a lookup table, not a rewrite: 11 invisible Unicode characters removed, 22 typographic marks replaced with plain ASCII, look-alike Cyrillic and Greek homoglyphs swapped back to Latin. Same input, same output, every time. No word is rewritten.

It is not a humanizer and we do not sell it as one. Run it in your browser from the hidden character detector, look at which characters it found and where they were hiding, then decide what you want to do about them.

FAQ

Can you remove an AI watermark from text?

You can remove hidden Unicode characters and homoglyphs, and decent tools do that reliably. Statistical marks such as SynthID-Text live in which words the model chose, so there is no character to delete and no field to blank. Rewriting changes the words. Deleting characters does not.

Does removing hidden characters make text undetectable?

No. Hidden characters are one signal among several, and classifiers that read the writing itself never depended on them. RAID's full test set already includes homoglyph and whitespace attacks, and Slop or Not caught 99.5% of AI text at a 5% false-positive rate on that benchmark with those attacks in play.

Can SynthID be removed?

SynthID is embedded in the generated media rather than attached as metadata, so ordinary stripping is the wrong mechanism. Heavy editing, aggressive recompression, or regeneration can degrade a readable signal, and the projects attempting it call their own results best-effort rather than guaranteed. Check the file instead of assuming, in either direction.

Does Claude put hidden characters in its text?

Anthropic describes its text watermark as a SynthID-Text mechanism that influences word choice, not as inserted invisible characters. A page offering to remove a Claude watermark by deleting zero-width spaces is describing a different mechanism from the one Anthropic documents.

Does a file with no metadata prove a human made it?

No. Missing metadata means the copy you checked carries no readable credential, and that happens constantly through screenshots, exports, and platforms that strip records automatically. Absence is not evidence of human authorship. It only removes one source of evidence from the check.

Check What Survived

Check the file, not the claim. Run text or a photo through the AI watermark detector to see which signals are actually there, or use the free online AI detector in your browser, where there is no account to create and your submission is deleted after processing. For checks that never leave your device, download Slop or Not for iPhone, iPad, and Mac, where detection runs on-device and uploads nothing.