AI watermarks explained: what they prove, and what they don't

Start with a situation, not a definition

Someone sends you a photograph and a report. You would like to know where they came from. You have heard that AI content is “watermarked” now, so you go looking for a tool to check.

Within about a minute you will hit the problem at the heart of this subject: the word watermark is doing the work of two unrelated technologies. They behave differently, they break differently, and only one of them can currently be checked by you at all. Sorting them out takes ten minutes and saves a great deal of embarrassment.

The first kind: a seal on the envelope

The photograph might carry a C2PA content credential — the standard backed by Adobe, Microsoft, the BBC, and most camera manufacturers. Think of it as a wax seal on an envelope, except the seal also lists what is inside and who packed it.

Inside that seal is a manifest: a record of what produced the file and what edited it. It is signed cryptographically, which is the part that makes it worth something. The signature covers a hash of the content — a short fingerprint calculated from the actual bytes. Change so much as one pixel and the fingerprint no longer matches, the seal breaks, and your tools will say so.

This is genuinely strong evidence, and it is the good news of this article. You can verify it yourself, right now, for free. Our file audit reads these manifests in your browser and tells you who signed the file, when, and whether it has been altered since.

But a seal proves the packing, not the contents

Here is where people over-read the result. A valid credential establishes two things: that a particular certificate signed the file, and that the bytes have not changed since. That is all.

It does not establish that the photograph shows something that really happened. A carefully staged scene, photographed on a real camera, produces a perfectly valid credential. Deciding whether an image depicts what it appears to depict is still journalism. The cryptography only tells you the file has not been quietly edited on the way to you.

And the seal is astonishingly easy to destroy

We measured this rather than assuming it. A validly signed file survived being copied, and was destroyed by resizing, recompression, screenshotting, and cropping — every single one. The full results are here.

The second kind: an accent in the voice

Now the report. Text watermarking works nothing like a seal, because there is no envelope to seal — paste text into an email and any wrapper around it is gone instantly.

So instead the mark goes into the writing itself. As the model generates text, it is nudged toward particular choices whenever several words would do equally well. Across a few hundred words that produces a statistical pattern — not a hidden character you could find and delete, but a faint bias in the vocabulary, like an accent in someone's speech. You cannot remove an accent by deleting a letter, because it is not in any one letter.

That makes it far more durable than a seal. It survives copy and paste, and Anthropic says it may persist through some editing. Anthropic began marking Claude's output this way on 2 August 2026, across its API, Claude, Claude Code, Claude Cowork, and Claude Tag, worldwide.

The catch nobody mentions

No one outside the model providers can currently read these watermarks.

Detecting a statistical watermark requires knowing the pattern that was used to create it. Anthropic has said it will publish technical documentation for detection, and an engineer has indicated an API is coming — but neither has arrived. Until they do, no independent tool can check Claude's watermark, and that includes this one. Any site telling you it checks text for AI watermarks today is doing something else and calling it that.

OpenAI, for its part, built text watermarking and shelved it, so ChatGPT text has no mark to find at all.

So what are those “invisible character” tools finding?

Something real, but unrelated. A whole category of sites scans text for zero-width spaces and other invisible Unicode, then presents the result as AI watermark detection.

Those characters do exist and are worth cleaning up — they break CMS imports and mangle formatting. But finding them tells you the text passed through some piece of software, which could just as easily be Word, a PDF export, or a copy-paste from a web page. It is a clue about the postal route, not about who wrote the letter.

Our own hidden character checker finds them, cleans them, and says exactly this: useful for text hygiene, useless as proof of authorship.

Why this all landed at once: Article 50

None of this arrived by coincidence. Article 50 of the EU AI Act became enforceable on 2 August 2026, requiring providers of generative AI to mark synthetic output in a machine-readable way. Three details matter:

• The transparency obligations took effect on 2 August 2026 and were not delayed by the Digital Omnibus, which pushed back only the high-risk deadlines.
• Machine-readable marking applies from 2 December 2026 for systems already on the market before August.
• The obligation sits on the provider of the AI, not on you for using its output.

The distinction that matters more than all of it

Whether it is a C2PA manifest or a statistical text watermark, a mark records that content was processed by a model. It does not record who authored it.

Picture two students. One writes an essay from scratch and pastes it in to fix the commas. The other types a prompt and submits whatever comes out. Both documents carry the same mark, and nothing in the mark distinguishes them — because the watermark is applied to whatever text passes through the model, regardless of who thought of it. A translation carries it. A tidied-up email carries it.

Anthropic states this plainly in its own documentation: detecting a mark tells you content may have been processed, and does not on its own confirm provenance. The company that built the watermark is more cautious about it than most tools selling detection.

So if you are using any of this to judge someone's work, treat it as one input to a human review and never as a verdict. The people most likely to be harmed by getting this wrong are the ones least able to argue back.