Guides
Claude Watermark: How Does It Work?
Claude watermark how does it work is the question everything else on this site depends on, and the answer is two different systems doing two different jobs.
Text is marked statistically. Files are marked with signed metadata. Confusing them is the single most common error in coverage of this topic.
Text: biased token sampling keyed to a secret. Files: cryptographically signed C2PA manifests.
Runs in your browser. No signup, no upload, nothing stored.
The text mechanism
A language model generates by repeatedly picking the next token from a probability distribution. At most steps, several tokens are near-equivalent — the sentence works either way.
A statistical watermark exploits that slack. A pseudo-random rule, seeded on a private key, partitions the candidate tokens into groups, and the model is nudged toward one group over the other.
Any single choice is unremarkable and defensible. Across a long passage the aggregate deviates from chance in a way the key-holder can measure, and nobody else can even look for.
Why it survives copy and paste
Nothing is attached to the text. The mark is the text — specifically, which words it used.
Copying carries the words, so it carries the pattern. This is why Anthropic says the mark travels when text is pasted elsewhere, and why it may persist through some editing: light edits change a few choices and leave the rest of the distribution intact.
The file mechanism
Files take a completely different approach: a signed provenance manifest following the C2PA standard, attached to .svg, .png and .jpg output.
It is real data sitting in the file's metadata container, cryptographically signed so alterations to the claim itself are detectable. Nothing about it is hidden or statistical — it is a record you can read.
Where each one is weak
The two mechanisms fail in opposite ways, which is worth holding in mind when deciding what to do:
- Text: cannot be deleted, but degrades under rewriting and needs length to detect
- Files: robust while present, but a metadata strip removes it entirely
- Text: no public detector exists yet
- Files: anyone can read the manifest today
Why this design was chosen
Each format got the strongest mechanism it could support. Images have a standard metadata container and an existing industry standard, so C2PA was available.
Plain text has no container at all — paste it into an email and any wrapper is gone. The only place to put a signal is the words themselves, which is why the text approach looks so different.
What it is for
The driver is EU AI Act Article 50, which requires machine-readable marking of AI-generated content.
Anthropic applied it worldwide rather than to EU users only, and there is no opt-out at any tier. The obligation sits on the provider, which is why user preference does not enter into it.
Source
The claims on this page are drawn from primary documentation and reporting rather than from other tools’ marketing copy.
Anthropic: How Claude marks AI-generated content →Related
Check what your text and files actually carry
Runs in your browser. No signup, no upload, nothing stored.