How Claude’s Text Watermarking Works (And What It Can’t Do)

Anthropic has published how text watermarking works in Claude. The short version: it changes which of several equally good words the model picks, it adds nothing to the text, and it exists because of a specific piece of EU regulation.

Here is what it actually does, what it cannot do, and what that means if you build with Claude or read text that might have come from it.

Why it exists: the EU AI Act

This is not a safety-research initiative that happened to ship. It is a compliance requirement with a date attached.

In July 2026, Anthropic signed the EU AI Act’s Code of Practice on Transparency of AI-Generated Content, alongside more than 190 other signatories including other major model providers. From 2 August, the EU requires AI providers serving its market to mark AI-generated content, and to give people a way to tell whether a text carries that mark.

Anthropic deployed the watermark globally rather than only for EU traffic. If you use Claude anywhere, this applies to your output.

How the watermark works

The mechanism is more elegant than the “hidden characters” people usually imagine, and it is worth understanding because it explains every limitation further down.

When a language model generates text, it is constantly making low-stakes choices — points where several different words would work equally well. Normally those choices come from an ordinary source of randomness. Watermarking replaces that source: the key, plus a few words that came before, decide which word the model picks.

In Anthropic’s words, “the words that Claude picks are still random, but now, one can check the sequence of words and see if it’s consistent with the choices Claude would make if it was using the key.”

Nothing is inserted. There are no zero-width characters, no invisible Unicode, no metadata. The signal is the word choices themselves.

What this means in practice

That fourth row is the one most often misunderstood. The watermark tells a detector that text is consistent with Claude’s keyed choices. It does not tell anyone who produced it. It is not a fingerprint on you.

The limitations, which are the interesting part

Anthropic documents four, and every one follows directly from the mechanism above.

Editing degrades it; rewriting kills it. Light editing probably will not remove the watermark completely. A complete rewrite, where every word is replaced, will. This follows logically: if the signal lives in which words were chosen, replacing the words replaces the signal.

Short text does not work. Detection needs enough word choices to accumulate evidence. On small samples there are fewer choices and therefore less information to go on. A tweet-length output is not reliably checkable.

Code is watermarked much less. Watermarking needs arbitrary choices to hide in, and code frequently has to be exact — a variable name may be free, but syntax is not. Anthropic states that code “has generally less watermarking than some other forms of text.”

Factual writing is watermarked less too. The same logic: watermarking is sparser on factual passages, because there are fewer word choices you can make without making the text less accurate.

Read those last two together and a practical conclusion falls out. The watermark is weakest exactly where people most want provenance — generated code, and dense factual text of the kind that turns up in academic or journalistic disputes. It is strongest in discursive prose, where word choice is freest. Anyone planning to lean on this as a detection mechanism should design around that, not assume uniform coverage.

Who can actually detect it

Not you, in the general case. The watermark is invisible to anyone without the detection API, and that API is in private preview.

Access is scoped to eligible organizations as required under EU law — regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations and EU civil society groups — plus enterprises with their own compliance obligations.

The practical consequence for the rest of us: you cannot paste a paragraph into a public tool and get an answer. And any third-party site claiming to detect Claude’s watermark does not have the key, so whatever it is measuring is not this.

What to do if you build with Claude

• Nothing technical is required. No API change, no flag, no cost difference. It is on.
• Do not treat absence of a watermark as proof of human authorship. Short outputs, code, and heavily rewritten text may not carry a detectable signal even when Claude wrote them.
• Do not treat it as a licence to skip disclosure. If your product generates text for users, your own transparency obligations are unchanged by a mark they cannot check.
• If you operate in the EU, the Code of Practice is the document to read, not the model provider’s blog post.

How it compares to image watermarking

Image and audio provenance schemes generally attach something: an imperceptible pattern in pixel data, or signed metadata such as C2PA content credentials. Both approaches can be stripped, though they survive in different ways — metadata is trivially removable, pixel-domain marks less so.

Text has no equivalent carrier. There is no pixel data to perturb and no lossy channel to hide in, which is why statistical approaches over word choice are the dominant design across the field rather than an Anthropic quirk. It also means the ceiling is lower: a determined person with a rewrite pass defeats it, and that is understood by the people who build these systems.

Sources

• Anthropic — How Claude’s text watermarking works (mechanism, quality and cost impact, limitations, detection access)
• European Commission — The EU AI Act
• Anthropic — Transparency Hub

Related reading