Remove watermarks from code

Characters that are in your file but cannot be seen. Zero-width spaces and joiners, bidirectional control characters, the Unicode tag block, variation selectors, soft hyphens, exotic whitespace such as the no-break space, and trailing whitespace. Every removal is reported with its codepoint, its Unicode name, how many times it occurred and which lines it was on, so you can verify the change rather than trust it.

All of them. The scan is model-agnostic: it looks at the characters in your file rather than at which assistant produced them, so there is no per-model list, no provider setting and nothing to configure. Code from ChatGPT, Claude, Gemini, Copilot, Llama, DeepSeek, Qwen, Mistral, Cursor, Cline or any other tool goes through the identical pass, and so does code a person typed by hand or pasted from a web page. Hidden characters do not care where they came from, which is exactly why one pass covers every source.

No, and no tool that edits characters can. Kirchenbauer et al. (ICML 2023) partition the vocabulary into a green and a red list at every step, keyed on a secret plus the preceding tokens, and nudge sampling toward green. SynthID-Text (Nature, 2024) uses tournament sampling and changes only the sampling procedure. Neither adds a character, so there is nothing to delete. The attack in the literature is rewriting, not editing, and rewriting source code through another model trades a provenance signal for a correctness risk. We measured our own scrubber against this: across 3,000 real model responses the default pass left the token sequence identical 88.5 percent of the time, and where it did change, it was trailing whitespace rather than anything hidden.

It weakens it, by degrees, and how much depends on the scheme. Where the green list is derived from the preceding run of tokens, changing the wording changes the partition and the green count drifts back toward chance. A light paraphrase only dilutes the signal, because it keeps long runs of the original wording; bringing detection down to chance takes a rewrite that shares no runs with the original. Schemes keyed on the words themselves rather than on context survive same-meaning rewrites better. None of this is something this tool does.

Not a third-party one. Detection is a statistical test over which tokens fell in the green list, and reproducing that partition requires the secret watermarking key. It does not require the model, which is what makes the scheme deployable, but without the key there is nothing to test. A public detector is inferring from style instead, which is a different question with a different error rate. A clean result from one of those and a clean result from us are answers to two different questions.

On the usual path it does the opposite. A zero-width character inserted into text splits a token that was whole, so the insertion is what disrupts tokenization; removing it restores the sequence exactly. We checked that directly: scrubbing text with an injected zero-width character reproduces the original token sequence byte for byte. Raw model output almost never carries these anyway, three responses in three thousand in our sample, which is why they nearly always arrive from a copy path rather than from the model.

No. Character-level watermarks, the kind this tool removes, are not how AI-generated code is identified in practice. Running a formatter such as black, gofmt or prettier already normalises most surface signals, and what remains is structure and style rather than hidden bytes. Treat this as a hygiene and security tool, not as a way to defeat attribution, and disclose AI assistance wherever you are asked to.

Almost never, and the exceptions are deliberate. Removing a character no one can see cannot change how code reads. It can change behaviour in one case: if a string literal deliberately contains a zero-width character and the program compares against it. That is rare, and it is also exactly the shape a hidden marker takes, so the finding is reported either way. Options that change visible characters, such as folding smart quotes, are off unless you turn them on.

CVE-2021-42574. Bidirectional control characters let a line of source display in one order and compile in another, so a reviewer approves code that does something other than what they read. A right-to-left override inside a comment can make an early return or a permission check appear to be commented out when it is not. These characters have no legitimate use in code, so this tool removes them and flags them as a security finding rather than as tidying.

The U+E0000 block is a shadow copy of printable ASCII that renders as nothing. It survives copy and paste, which makes it the usual carrier for instructions smuggled into text that a language model will later read. Reporting that hidden characters exist is not very useful, so we decode the run back into ASCII and show you what it says. Seeing the sentence is what tells you whether you are looking at a marker or an injected instruction.

Because we cannot tell an attack from a language. A Cyrillic small a inside an identifier is a classic supply-chain trick, since the token looks identical to a Latin a and compares as different. The same character in a Russian comment or string is simply Russian. Silently rewriting it would corrupt legitimate source, so the default points at the line and lets you decide. Turn the option on if you want the substitution made.

Because they are visible, and folding them rewrites bytes inside string literals as well as in code. A curly quote pasted into a source file is usually a syntax error and worth fixing, but changing the contents of a string is a decision a person should make. It is one checkbox away rather than automatic.

Yes. The scrubber works on characters rather than syntax, so it does not parse or care about the language. That is also its boundary: it will not reformat code, rename anything or touch structure. Anything it changes is a character that was invisible or a run of whitespace at the end of a line.

Yes. Sign in with Google and a free API key is created for you automatically, with no credit card. The account is what lets us rate limit per caller rather than per IP address, which matters because an endpoint that accepts whole source files is easy to abuse from a shared network.

No. The scrub runs in the request that carries it and the content is not written to a database or a log. Only the fact that a key made a call is recorded, which is what the rate limit is counted from.

Yes, and the endpoint has a mode for it. Send inspect set to true and you get the findings without the cleaned text, which is what a check wants: it should fail the build and tell a human, not rewrite the tree behind their back. Fail on any finding where security is true and you have a Trojan Source and hidden-payload gate in about five lines of shell.

200,000 characters per request, which is a large source file, and the standard per-key daily request limit. There is no token cost, because nothing is sent to a language model: the scrub is a local pass over the characters, so it consumes none of your daily token budget.