How Claude's invisible watermark works: and what it means for you
Anthropic explains its SynthID-Text watermarking for Claude: how it works, what it survives, its limits, and a detection API coming soon.
On 15 August 2026, Anthropic published a detailed explanation of how Claude’s new invisible text watermarking actually works. If you missed the initial announcement earlier that month, the short version is this: every piece of text Claude generates now carries a hidden statistical signature. The 15 August post gets into the mechanics, the limits, and what Anthropic plans to do next. It is worth reading carefully, because there are some important nuances that the headline-level coverage has glossed over.
The basic mechanism: seeded randomness, not hidden characters
Claude, like all large language models, generates text one token at a time. At each step, it has a list of plausible next words and picks among them. Normally, that final selection involves a degree of randomness, think of it as rolling a weighted die.
Watermarking replaces the arbitrary random number generator with one that is seeded by a secret key. Anthropic uses the pi analogy in its post: instead of picking a random digit, the model uses digits of pi (or rather, a proprietary key) to settle which word it picks when multiple options are equally good. The words still feel natural and appropriate to the context. The pattern is invisible to a human reader, but someone with the key can run a statistical check and determine whether the text is likely to have come from Claude.
Crucially, nothing is inserted into the text. There are no hidden characters, no zero-width spaces, no metadata attached to a document. The watermark is woven into the word choices themselves.
What survives, and what does not
Because the watermark lives in the text rather than in a file wrapper, it travels wherever the text goes. Copy it into a Google Doc, paste it into an email, convert the file to plain text, the watermark is still there. Anthropic confirms it “may persist through some editing” too, meaning light revisions are unlikely to scrub it.
A complete rewrite is a different matter. If someone replaces every word in a Claude-generated paragraph, the statistical pattern is gone. Anthropic acknowledges this plainly, and one of their engineers made the reasonable point that at that stage it is a stretch to call the output AI-generated in any meaningful sense.
Code is a special case. When Claude writes a function, most of the words are not free choices, the syntax has to be correct, and the logic has to work. There is less room to embed a pattern. The watermark is still applied, but it will be weaker than in free-form prose. Anthropic notes that arbitrary choices within code, such as variable names or comments, can still carry the signal.
Short texts are also harder to detect reliably. The statistical check needs enough word choices to find the pattern. A two-sentence reply does not give it much to work with.
A detection API is coming
Anthropic has confirmed it will offer a public watermark detection API. The implementation details are still being finalised as of 15 August 2026, but the direction is clear: third parties will be able to submit text and ask whether it carries Claude’s watermark.
A few things worth understanding about what that API will and will not do:
- It tells you whether Claude was likely involved in producing the text. It does not tell you that a human did not write it.
- It cannot detect output from GPT, Gemini, or any other model. It is a Claude provenance detector, not a general AI detector.
- A positive result does not mean “AI wrote this.” If a human writes something and then asks Claude to proofread or translate it, the resulting text will carry a watermark even though a human wrote the original draft.
That last point is the one most likely to cause problems in practice, and Anthropic is direct about it: the watermark “is not fully conclusive” that content was entirely AI-generated.
Why this is happening now
The immediate driver is the EU AI Act’s Transparency Code, which took effect on 2 August 2026. It requires AI providers to mark AI-generated or AI-edited content in a way that other systems can identify. Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026, along with roughly 190 other signatories.
Rather than limit watermarking to Europe, Anthropic is applying it globally. The stated reason is that they do not yet have a reliable way to scope it by region without creating gaps. The watermark applies across the Claude API, Claude.ai, Claude Code, Claude Cowork, Claude Tag, and third-party deployments via AWS, Google Cloud, and Microsoft Foundry.
The SynthID-Text approach Anthropic is using is not new to the AI industry. It draws on a 2024 paper from Google DeepMind published in Nature, which itself builds on an earlier proposal by Scott Aaronson from 2022. Other labs are implementing similar approaches.
The file metadata piece
Alongside the text watermark, Anthropic is also adding signed provenance metadata to supported file types including SVG, PNG, and JPG. This uses the C2PA open standard developed by the Coalition for Content Provenance and Authenticity. Unlike the text watermark, C2PA metadata is not hidden inside the file content, it is attached as a verifiable credential. It can signal that Claude was involved in producing or modifying the file, and it includes tamper-detection mechanisms that flag if the metadata has been altered or replaced.
What this means for you
If you use Claude in your work, a few things are worth keeping in mind:
For writers and knowledge workers: Text you generate with Claude carries a statistical signature. Light editing will not remove it. If you are submitting work to an employer, academic institution, or client that prohibits AI-generated content, you need to be aware that Claude-watermarked text could, in principle, be detected, even if those detection systems are not yet widely deployed. A full rewrite removes the watermark, but at that point the attribution question becomes academic anyway.
For developers: The forthcoming detection API is worth watching. It will give you a programmatic way to check whether content in your pipeline has been processed by Claude. That could be useful for content moderation, provenance logging, or compliance workflows. Bear in mind it is Claude-specific, it will not catch output from other models.
For organisations concerned about misuse: The watermark is a useful signal, but Anthropic is clear that it should not be treated as proof of AI authorship. Anyone building a policy around it, schools, publishers, employers, should think carefully about the difference between “Claude was involved” and “a human did not write this.” Using the watermark as the sole basis for disciplinary action would be a mistake.
For everyone: The model itself does not know it is being watermarked. The watermark adds no latency, no cost, and no visible change to outputs. For the vast majority of users, day-to-day use of Claude is entirely unaffected.
The full technical explanation is on Anthropic’s blog, and more operational detail is in their Help Centre article. When the detection API launches, Anthropic has said they will share further details.