Anthropic · web chat
Claude Watermark Remover for Code and Artifacts
Claude is used through the web app, a desktop app, the Messages API and Claude Code in a terminal, and each of those hands code over in a genuinely different way. This page maps those four routes and what each one is capable of attaching to a snippet. The scan underneath is model-agnostic and reads characters only, but what you should watch for depends on how the text reached your disk.
Scan your Claude code now
Free, and it reports every removal by codepoint and line.
Claude now marks its AI-generated content
Anthropic embeds an imperceptible watermark into text Claude generates and attaches signed C2PA provenance metadata to files such as .svg, .png and .jpg. It applies everywhere Claude is used, including the API and Claude Code. Models launched in the EU on or after 2 August 2026 support it at launch, and existing models are described as in progress.
Can this tool remove it? No. Anthropic does not publish the algorithm, but the behaviour it describes, surviving copy and paste while fading when text is heavily edited, paraphrased or translated, is characteristic of a token-level scheme rather than hidden characters. Nothing is inserted, so nothing can be deleted: this scanner will report such a file as clean and the mark will still be there. C2PA metadata on images is also outside what this tool touches.
What we measured
68
code-generation calls
17
provider and model targets
59,486
characters generated
0
contained a hidden character
On 2026-08-12 we sent identical code-writing prompts to every model our own gateway can reach and scanned each raw API response. Not one of them contained a zero-width character, a bidirectional control, or a tag character.
3 of the 68 answers contained typographic punctuation, and only in the prose-heavy prompts rather than in the plain code one. The most common was the non-breaking hyphen, which is visible but still breaks a copied command. 2 left trailing whitespace.
The useful conclusion is the boring one: raw model output is essentially clean, so when you do find hidden characters in your file, they almost certainly came from the path the text travelled rather than from the model. That is what the section below is about.
Scope: this measured API output from models we can reach directly. It did not measure the Claude web app, which is the point being made, since the browser is where the characters get added.
How code gets out of Claude, and what each path adds
The button copies a string built from the rendered page, so it inherits the page typography. That means no-break spaces, soft hyphens and any zero-width characters that were in the output survive into your clipboard. Selecting prose by hand is worse again, because inline code inside a sentence sits in the same typographic layer as the sentence around it.
An artifact renders in its own pane and offers a download as well as a copy. The download writes bytes to a file with no clipboard and no selection model in between, which makes it the cleanest way to get code out of a browser at all. Copying from the artifact pane is an ordinary DOM to clipboard step and carries the usual residue, so prefer the download when the artifact is a file you intend to run.
Claude Code edits files directly through its own tools, so nothing crosses the clipboard and nothing round-trips through HTML. What can still land in a file is what the model wrote into the string, plus anything it lifted from something it read during the task: a fetched web page, a pasted stack trace, a dependency README. Patches and diffs carry those through unchanged, and a review in a terminal will not show them to you.
Raw strings, no rendering layer, nothing added in transit. One detail worth knowing if you stream: the text arrives as many small deltas, and a sequence such as a base character followed by a variation selector can straddle a chunk boundary. A filter applied per delta can miss what a scan of the finished file catches, so run the check on the assembled output.
Because Claude Code and other agents read files as input, invisible characters matter in both directions here, which is not true of a chat-only workflow. A run of characters from the Unicode tag block (U+E0000 and up) renders as nothing at all in an editor or a browser but decodes straight back to readable ASCII, which makes it the usual carrier for smuggled instructions in a README, an issue body or a scraped page. Running untrusted input through the checker before an agent reads it is worth as much as running generated output through it afterwards. The same applies to material you paste into a Project knowledge base, since whatever you paste in is available to come back out later.
What this does not do
It does not remove statistical watermarking. Schemes of the SynthID family add no characters at all: they bias which token the model samples, so the signal lives in word choice across the whole output and nothing you can delete carries it. Attacking that means rewriting the text, which for source code risks changing what it does.
This is a hygiene and security tool, not an attribution bypass. Formatters already normalise surface signals, and what identifies generated code is structure and style rather than hidden bytes. Disclose AI assistance wherever you are asked to.
Claude questions
Is downloading an artifact cleaner than copying it? +
Yes, in the narrow sense that matters. A download serialises the artifact content to a file without going through the clipboard or the browser selection model, so typographic substitution has no opportunity to happen. Copying from the pane goes through the page, which is where no-break spaces and curly quotes get picked up.
Claude Code writes files directly, so why check its output? +
Skipping the clipboard removes copy-paste artefacts, not every invisible character. Anything the model emitted as part of the string is written verbatim, and anything it copied from a page, a log or a dependency file during the task comes along with it. A file that an agent wrote is exactly as worth scanning as one you pasted.
Does this remove a watermark from Claude output? +
No. Statistical watermarking, if present in any model, is a bias in which tokens get sampled, so it is carried by the wording and no character edit touches it. This tool reports and deletes characters that are in the file but cannot be seen. It makes no claim about detection or attribution and should not be used as an attempt to defeat either.
My diff shows a changed line that looks identical to the old one. Why? +
That is the classic signature of an watermark: a zero-width space, a no-break space in place of U+0020, or trailing whitespace. Terminal diffs render all three as nothing. Piping the line through cat -A, or turning on whitespace error highlighting in git, will show it, and pasting the file here will tell you the codepoint and the line.