What a mark actually means

Two different mechanisms get called “the Claude watermark”, and conflating them produces most of the confusion online. They behave differently, they can be checked by different people, and they fail in different ways.

The file signature

When Claude produces an image or another supported file, it attaches a C2PA manifest: structured metadata, cryptographically signed, recording what produced the file and what was done to it. This is an open standard. Anyone can read it — the inspector on the home page does exactly that, in your browser.

A manifest is only as meaningful as its signature. A file can carry a well-formed manifest claiming anything at all; what separates a real one from a fabricated one is whether the signing certificate chains to a certificate authority on the C2PA trust list, and whether the hash bindings still match the pixels. MarkCheck deliberately does not perform those checks, and says so on every report. It shows you what the file asserts.

The practical weakness of file signatures is not forgery, it is erasure. A screenshot destroys the manifest. So does most re-encoding, most resizing, and most social platforms.

The text watermark

For text there is nothing attached at all. Anthropic biases the model’s word choices during generation so that, across a long enough passage, the output carries a statistical signature. The pattern survives copy-paste because it is the words. It reportedly survives a fair amount of editing for the same reason.

This has a consequence people keep missing: you cannot check it yourself. Anthropic has not published the method, so no third party can compute the detection. Any site offering to tell you whether a piece of text carries Claude’s watermark is guessing — usually by counting em-dashes and looking for zero-width spaces, neither of which has anything to do with it.

The same fact undercuts the removal business from the other direction. If a tool cannot detect the mark, it cannot verify that it removed it. Stripping invisible characters produces a file that looks processed while the actual signal sits untouched in the vocabulary.

“Processed by”, not “written by”

This is the most important sentence on this page, and it comes from Anthropic’s own documentation: a detected mark indicates the content may have been processed by Claude. It does not indicate that Claude wrote it.

The following all produce marked output from writing that is entirely a person’s own:

• Asking Claude to proofread a draft you wrote
• Asking it to translate your own work into another language
• Asking it to summarise, condense or restructure something you wrote
• Asking it to fix the grammar of a paragraph you struggled with

In every one of those cases the ideas, the research and the argument are the author’s. The mark is present anyway, because the tokens came out of the model. A rule that treats detection as proof of authorship punishes the person who used a spell-checker exactly as hard as the person who generated the whole essay.

This falls hardest on people writing in a second language, who use AI assistance for fluency rather than for content. They are already over-flagged by conventional AI detectors. A provenance mark that cannot distinguish proofreading from ghostwriting stacks a second penalty on the same group.

Absence proves nothing at all

The inverse error is just as common. There is no detectable signal on:

• Output from models released before 2 August 2026
• Output from any other company’s model
• Passages too short to carry a statistical signature
• Heavily paraphrased or rewritten text
• Files whose metadata was stripped by a screenshot or a format conversion

So “no mark found” is not a clean bill of health, and cannot be used as one. An institution that treats an unmarked document as verified human work has misunderstood the tool as badly as one treating a marked document as proven cheating.

Why this exists

The driver is regulatory. The EU AI Act requires providers of generative systems to mark synthetic output in a machine-readable way. Anthropic chose to apply it worldwide rather than maintain a separate EU build, which is why it reached everyone at once. Marking is a transparency obligation on the provider — it was not designed as an enforcement instrument for schools or employers, and it does not work well as one.

An Anthropic engineer put the limitation plainly: it is not perfect, it can be edited around, and it is a first step. That is a reasonable description of a provenance signal. It is a terrible description of evidence, and it should be read accordingly by anyone about to make a decision about another person based on it.

Using this well

A mark is a starting point for a conversation, not the end of one. If you are assessing someone else’s work, the honest questions are what they did, what the tool did, and whether that split was permitted — none of which a watermark can answer. If you are the one being assessed, the next page covers what actually helps.