How to Remove Claude Watermarks from Text, Code and Files

Claude now marks AI-generated content. But it does not mark everything the same way.

Anthropic currently uses embedded watermarks for text and signed C2PA provenance metadata for supported files. Code sits somewhere in between: it is still text, but its structure gives the watermark fewer places to work.

I went into detail about Claude’s watermarks in my article how Claude’s watermarking works, and here I’d answer the obvious question:

You’ll soon find out the watermark isn’t hard to remove at all.

Remove Claude Watermark from Text

This is the hardest case. At least on paper, because:

In fact, Claude does not add a hidden character that you can search for and delete.

Anthropic says its watermark is based on SynthID-Text. This is the text variant of the traditional SynthID that is used by Gemini models for watermarking.

Furthermore, the model changes the source of randomness it uses when choosing between possible words. Across a sufficiently long passage, those choices create a statistical pattern that can be detected later.

For example,

Click here to view the functionality of SynthID-Text

Think about these three sentences:

1. The compiler rejected the patch.
2. The patch was rejected by the compiler.
3. The compiler wouldn’t accept the patch.

They’re essentially relaying the same information, although in a different manner (wording wise). This minor change would barely be detected by a human, but machines can hide patterns using such seemingly safe choices.

In addition, a model has some freedom to choose between them. Therefore, that freedom is where a text watermark is placed. It’s all in the patterns…

Rewrite, don’t “strip”

However, there is no metadata-cleaning operation for Claude’s text watermark. Since the watermark is a pattern that is distributed across text:

1. Edits wouldn’t be sufficient
2. Copying the text to another editor does not solve it

What does work then?

Rewriting the text is the ideal choice for countering watermarks. But if you’re not interested in an overhaul, paraphrasing would suffice. Similarly, this is important because there are a lot of paraphrasing tools freely available online:

That gives us a simple rule:

Nevertheless, changing the file does not remove a text watermark. Changing the text does.

Python approach

Since the watermarking is in Claude’s writing, redoing the text in other LLMs (which don’t have SynthID-Text) would reduce the watermarks.

The following code uses a generic OpenAI-compatible endpoint. Using a model other than Claude for the rewrite:

import os
from openai import OpenAI


def rewrite_text(text: str) -> str:
    client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])

    prompt = f"""
Rewrite the following text completely in new wording.

Rules:
- Preserve the facts and meaning.
- Preserve technical accuracy.
- Change sentence structure throughout.
- Do not merely replace a few words with synonyms.
- Rebuild paragraphs where useful.
- Return only the rewritten text.

TEXT:
{text}
"""

    response = client.responses.create(
        model=os.getenv("REWRITE_MODEL", "gpt-5"),
        input=prompt,
    )

    return response.output_text


if __name__ == "__main__":
    original = open("input.txt", "r", encoding="utf-8").read()
    rewritten = rewrite_text(original)

    with open("output.txt", "w", encoding="utf-8") as f:
        f.write(rewritten)

This would reduce the watermarks.

Removal isn’t guaranteed unless we plug in a detector to confirm the output watermark percentage. But this should suffice as a starter code.

Remove Claude Watermark from Code

Code is more interesting.

Meanwhile, Anthropic does not describe a separate “code watermark.” Generated code falls under the text watermarking system. But code contains far fewer arbitrary choices than normal prose. This is because programs must follow a definite syntax.

For example:

for i in range(len(users)):
    process(users[i])

could legally become:

for index in range(len(users)):
    process(users[index])

The program behaves the same.

• A variable name can change.
• A comment can change.
• Formatting can change.

But you cannot arbitrarily change a required Python keyword or API call without potentially breaking the program.

That is why watermarking is naturally weaker in code.

A Python AST rewrite

For Python code specifically, we can make substantial source-level changes while preserving the program’s structure.

The script below:

• renames local identifiers,
• removes comments,
• removes standalone docstrings,
• reconstructs the source using Python’s AST.

import ast
import keyword
import random
import string
from pathlib import Path


class IdentifierRenamer(ast.NodeTransformer):
    def __init__(self, seed: int = 42):
        self.rng = random.Random(seed)
        self.mapping = {}

    def _new_name(self, old_name: str) -> str:
        if old_name in self.mapping:
            return self.mapping[old_name]

        prefix = random.choice(["tmp", "value", "item", "obj", "data"])
        suffix = "".join(
            self.rng.choice(string.ascii_lowercase)
            for _ in range(5)
        )

        candidate = f"{prefix}_{suffix}"

        while keyword.iskeyword(candidate):
            suffix = "".join(
                self.rng.choice(string.ascii_lowercase)
                for _ in range(6)
            )
            candidate = f"{prefix}_{suffix}"

        self.mapping[old_name] = candidate
        return candidate

    def visit_Name(self, node):
        node.id = self._new_name(node.id)
        return self.generic_visit(node)

    def visit_arg(self, node):
        node.arg = self._new_name(node.arg)
        return self.generic_visit(node)

    def visit_alias(self, node):
        if node.asname:
            node.asname = self._new_name(node.asname)
        return self.generic_visit(node)


def remove_docstrings(tree: ast.AST) -> None:
    for node in ast.walk(tree):
        if not isinstance(node, (ast.Module, ast.FunctionDef,
                                  ast.AsyncFunctionDef, ast.ClassDef)):
            continue

        if not node.body:
            continue

        first = node.body[0]

        if (
            isinstance(first, ast.Expr)
            and isinstance(first.value, ast.Constant)
            and isinstance(first.value.value, str)
        ):
            node.body.pop(0)


def rewrite_python(source: str) -> str:
    tree = ast.parse(source)

    remove_docstrings(tree)

    transformer = IdentifierRenamer()
    tree = transformer.visit(tree)

    ast.fix_missing_locations(tree)

    return ast.unparse(tree)


def rewrite_file(input_path: str, output_path: str) -> None:
    source = Path(input_path).read_text(encoding="utf-8")
    rewritten = rewrite_python(source)

    Path(output_path).write_text(
        rewritten,
        encoding="utf-8",
    )


if __name__ == "__main__":
    rewrite_file(
        "input.py",
        "rewritten.py",
    )

This is intentionally a source transformation, not a watermark decoder.

Finally, it changes substantially more of the generated surface than simply replacing one variable name.

And there is an important caveat: AST reconstruction can change formatting and some source-level details. Test the resulting program before using it.

The same logic applies to comments. They have much more linguistic freedom than executable syntax, so they provide more opportunities for statistical marking.

Remove Claude Watermarks from Files

Anthropic does not hide a watermark inside the pixels of supported images.

Instead, Claude attaches a cryptographically signed C2PA content credential to supported file types such as .png, .jpg, and .svg. The credential lives in the file metadata and records that Claude processed the asset.

This is an important distinction.

The image itself can remain unchanged. The provenance record sits alongside it as the metadata (header specifically) of the file.

That also means creating a new derivative file can break the link to the original manifest. Anthropic explicitly lists format conversion, re-saving, screenshots, and similar operations as ways metadata may be stripped.

Use Python to inspect the file

The official C2PA Python library can read and validate manifests from supported media files. Install the library using:

pip install c2pa-python

Then use the following code:

import json
from c2pa import Context, Reader


def inspect_c2pa(path: str) -> dict | None:
    try:
        with Context() as context:
            with Reader(path, context=context) as reader:
                data = reader.json()

        return json.loads(data)

    except Exception as exc:
        print(f"No readable C2PA manifest: {exc}")
        return None


if __name__ == "__main__":
    manifest = inspect_c2pa("image.png")

    if manifest:
        print(json.dumps(manifest, indent=2))

This answers the first question:

Does this file contain a C2PA manifest?

Do not strip metadata blindly. Check first.

What About PDFs and Other Files?

This is where you should be careful with broad claims.

Anthropic says provenance metadata applies where Claude supports processing files. Its current documentation explicitly gives .svg, .png, and .jpg as examples. It also says some platforms or features may not support every marking type.

So don’t write:

“Every Claude PDF has a watermark.”

That isn’t what Anthropic documents.

The Python C2PA library is useful here too because it can read supported media files rather than relying on assumptions.

Can You Remove the Mark Completely?

Let’s face the bottom-line:

Text

A complete rewrite can fully remove the original Claude watermark. Light editing may not.

Difficulty: Moderate
Recommended Tool: Quillbot paraphrases your text for free.

Code

Code behaves like text, but its watermark is generally weaker because there are fewer reasonable choices. Significant source transformation can change the original statistical pattern, but there is no official Claude code-watermark removal API.

Difficulty: Hard

Files

A C2PA credential is metadata. Creating a new derivative file can leave the original manifest behind. Anthropic explicitly lists format conversion, re-saving, and screenshots among operations that can strip file metadata.

Difficulty: Easy

The Practical Solution

The three cases are fundamentally different:

Just follow the steps outlined in this article to deal with the Claude watermark issue going forward.

Frequently Asked Questions

Studying, evaluating, and explaining AI systems for over 6 years.

“𝘖𝘯𝘤𝘦 𝘮𝘦𝘯 𝘵𝘶𝘳𝘯𝘦𝘥 𝘵𝘩𝘦𝘪𝘳 𝘵𝘩𝘪𝘯𝘬𝘪𝘯𝘨 𝘰𝘷𝘦𝘳 𝘵𝘰 𝘮𝘢𝘤𝘩𝘪𝘯𝘦𝘴 𝘪𝘯 𝘵𝘩𝘦 𝘩𝘰𝘱𝘦 𝘵𝘩𝘢𝘵 𝘵𝘩𝘪𝘴 𝘸𝘰𝘶𝘭𝘥 𝘴𝘦𝘵 𝘵𝘩𝘦𝘮 𝘧𝘳𝘦𝘦. 𝘉𝘶𝘵 𝘵𝘩𝘢𝘵 𝘰𝘯𝘭𝘺 𝘱𝘦𝘳𝘮𝘪𝘵𝘵𝘦𝘥 𝘰𝘵𝘩𝘦𝘳 𝘮𝘦𝘯 𝘸𝘪𝘵𝘩 𝘮𝘢𝘤𝘩𝘪𝘯𝘦𝘴 𝘵𝘰 𝘦𝘯𝘴𝘭𝘢𝘷𝘦 𝘵𝘩𝘦𝘮.” — 𝖥𝗋𝖺𝗇𝗄 𝖧𝖾𝗋𝖻𝖾𝗋𝗍, 𝖣𝗎𝗇𝖾