How to Detect a Claude Watermark: Text Marks and C2PA Verification

Update — August 12, 2026: Anthropic has now confirmed that a text detection API "that you can use yourself" is coming — moving detection from "forthcoming documentation" to an announced product. It is still not callable, and no pricing or access tier has been published. The engineer who confirmed it also conceded the mark "is not perfect, you can edit it, but it's a first step." See what the announcement changes below, plus our new pieces on whether every model will watermark and whether detection is monetisable.

You can already verify half of Claude's new provenance system — just not the half most people are asking about. Anthropic confirmed on August 11, 2026 that Claude models launched on or after August 2, 2026 embed an invisible watermark in generated text and attach signed C2PA metadata to supported files. Our companion piece on the announcement covered what gets marked and what doesn't. This post covers the question that follows immediately: how would anyone actually check?

The honest answer splits in two. C2PA file verification is a mature, already-deployed open standard — you can check a manifest today with free tools. Text watermark detection is not public yet; Anthropic's own documentation calls it "forthcoming." Conflating the two, as much of the reaction online has, leads to wrong expectations about what you can verify right now.

TL;DR — what you can check today

Two provenance mechanisms, two different verification stories

Anthropic's announcement bundles two technically unrelated systems under one policy. They need separate detection stories because they work — and fail — in opposite ways.

Text watermarks: detection doesn't exist publicly yet

Anthropic's own description is that the mark is "woven directly into the text itself" via token-level statistical bias, not metadata you can inspect with a file tool. Published watermarking literature (Anthropic hasn't confirmed its exact scheme) generally works like this:

1. At each generation step, the model has many "equivalent" next-token choices that don't change meaning or quality.
2. A secret key nudges which of those equivalent tokens gets picked, in a pattern invisible to a reader.
3. A detector holding the same key rescans a passage and measures whether token choices skew toward the key's preferred pattern more than chance would predict.
4. Given enough tokens, that skew becomes a statistically significant signal — short passages don't carry enough signal to be reliable.

The key has to stay secret for the scheme to work at all. If Anthropic published the exact bias pattern, anyone could reverse-engineer text that passes or fails detection on demand — which is exactly why no lab using this approach open-sources its detector. That's also why "just write a script to check it yourself" isn't a real option: there is nothing public to check against.

As of this writing, Anthropic has not shipped a detection API, web tool, or technical spec. The EU AI Act's Article 50(2) Code of Practice — the regulation driving this whole rollout, covered in our EU AI Act policy guide — requires signatories to support third-party detection, so something is coming. Whether it's a public API, an enterprise-gated endpoint, or a request-based process for educators and platforms is still unknown.

You can still run a general style check while waiting. The explainx.ai AI content detector looks for transparent patterns such as unusually uniform sentences, formulaic phrasing, repeated openings, and regular paragraph structure. That is useful for triage, not attribution: it does not read Claude's watermark, identify a specific model, or prove that AI wrote the passage.

C2PA file metadata: you can verify this today

This is the more useful half for anyone who wants to check something right now, because C2PA isn't new or Anthropic-specific. It's an open Coalition for Content Provenance and Authenticity standard already deployed across LinkedIn, camera manufacturers, and other generative-AI tools — our breakdown of LinkedIn's C2PA rollout for AI images covers the same manifest format at platform scale.

Here's how the check actually works:

1. A C2PA-conformant file (Claude's supported types: .svg, .png, .jpg) carries a signed manifest alongside the pixel data — not hidden inside it like the text watermark.
2. The manifest records what tool produced or edited the file and a cryptographic hash of the content at signing time.
3. A verifier — a free web tool, a browser extension, or a platform's built-in check — reads the manifest, confirms the signature chains to a valid certificate, and recomputes the content hash to compare against the recorded one.
4. You get one of three results: valid (unaltered since signing, signer identity confirmed), no data (no manifest present), or invalid/tampered (the content changed after signing, or the signature doesn't check out).

You can run this check today, independent of anything Anthropic ships, using existing C2PA-conformant verifiers such as Content Credentials Verify. The catch is the opposite of the text watermark's problem: verification tooling already exists, but the manifest itself is fragile. Re-saving a PNG through most image editors, converting formats, screenshotting the result, or uploading through a platform that strips metadata on ingest all produce a "no data" result — which looks identical to content that was never marked in the first place. A "no data" verdict is not evidence of anything; it's an absence of evidence.

See the text-watermark side of that table in action

Text watermark detection has no public tooling yet, but the underlying mechanism is easy to demonstrate. Play with a teaching version of the keyed word-choice bias and the detection count below — the same core idea covered in explainx.ai's full breakdown of how AI text watermarking works.

What a detection result actually tells you — and what it doesn't

This is the part worth internalizing before any detector ships, because the misuse pattern is predictable. Our earlier coverage of classical ML approaches to LLM text detection already documented how the last generation of AI-detection tools got treated as verdicts by schools and employers despite being probabilistic classifiers with real false-positive rates. A cryptographic watermark is a stronger signal than an SVM classifier trained on stylistic features — but "stronger signal" and "proof" remain different categories.

Anthropic's own caveats, worth restating precisely:

A positive result does not mean Claude authored the ideas. Proofreading, translating, summarizing, or reformatting your own writing through Claude can leave a detectable mark on content whose substance is entirely human. If your organization treats a watermark hit as equivalent to a plagiarism finding, it will misfire on exactly this case.

A negative result does not mean a human wrote it. No detectable mark can mean: the content came from a pre-August-2 model still in the transition period, was heavily paraphrased or translated, is too short to carry a reliable signal, had its C2PA metadata stripped by re-saving, or came from a surface Anthropic doesn't cover. "Undetected" and "unmarked" are not the same claim.

There is a blunter way to say all of this, and it is worth saying plainly: a watermark hit carries almost no meaning about the content it marks. It does not tell you who authored the ideas, how much of the text a human wrote, whether the work is good, whether it was disclosed, or whether the person submitting it did anything wrong. The only proposition it supports is "a model was somewhere in this document's history" — which, in a year when most professional writing and code passes through a model at some point, is close to saying nothing at all. A signal that is nearly universal is a signal that discriminates between almost nothing.

Update — August 16, 2026: Anthropic's interactive explainer states the output type outright: a watermark check "never answers yes or no — it returns a probability that Claude was involved." Confidence is built from open choices, the points where several continuations were equally good and chance picked one. Every choice matching the key adds evidence; text with no open choices yields no evidence at all.

That gives you a diagnostic to apply before you take any result seriously. Anthropic's own ranking of seven equal-length answers puts open prose at 3–4 open choices per sentence, factual recall and summarization at 3, code at 2, quotation at 1, and proofreading and extraction at zero. A negative on a proofread paragraph or an extracted list is not weak evidence of human authorship — it is no evidence, because that text could not have carried a mark under any circumstances. If you are evaluating a disputed document, classify what kind of writing it is first; for pinned text, the check is uninformative by construction and should not be run at all.

Our free capacity checker applies exactly this test to a pasted passage — it estimates how much room the text left for a watermark before anyone reads a detection result into it. It cannot check for Anthropic's mark (that needs the secret key), and no public tool can.

Put together: this system is built to produce a weak positive signal and effectively no negative signal. It's designed for checking provenance at scale — flagging candidates for review — not for adjudicating a single disputed case. Anyone building a policy around watermark detection (an admissions office, a publisher, a content platform) should write "detected ≠ proven" into the policy text before the first dispute arrives, not after.

The right way to repurpose Claude output without fighting the system

If the actual goal is using Claude-assisted writing in something you'll publish, submit, or ship — a blog post, a report, code documentation — the compliant path isn't trying to defeat a provenance signal. It's the same editorial discipline that predates watermarking entirely:

1. Re-author substantively, don't just reformat. Restructure the argument, add your own sourcing and analysis, and cut or rewrite anything you're keeping verbatim. Heavy, genuine editing is also the one thing Anthropic lists as actually reducing watermark reliability — because the text has materially changed, not because you targeted the mark.
2. Disclose AI assistance where it's required. If you operate somewhere the EU AI Act's Article 50 transparency obligations reach your product or publication, Anthropic's own guidance is that you must independently assess what disclosure Article 50 requires of you — the model-level mark doesn't discharge that obligation for your organization.
3. Keep your own provenance trail. Drafts, prompts, and revision history are better evidence of authorship process than fighting a detector after the fact — and they're what most institutional AI-use policies actually ask for.
4. Treat file metadata the same way. If you're distributing an image or document that passed through Claude, leaving the C2PA manifest intact is the disclosure-friendly default; stripping it to look "unmarked" just produces the same ambiguous "no data" result a routine re-save would, with worse optics if anyone asks.

None of this requires defeating anything. It's the difference between using a tool and laundering its output.

What the detection API announcement changes

On August 11, 2026, an engineer on Anthropic's Claude Code team confirmed the piece this entire post was waiting on: "We'll also be shipping a text detection API that you can use yourself." Three things follow, and one does not.

What changes: detection is no longer hypothetical. "Forthcoming documentation" has become an announced product with a stated audience — customers, not just internal tooling or an enterprise-gated partner program. That is a meaningfully better outcome than the gated scenario this post flagged as possible.

What does not change: nothing is callable yet. There is no endpoint, no pricing, no rate limit, no published false-positive rate, and no ship date. Every operational recommendation above still stands, because you still cannot check a passage today.

What the announcement made worse, not better: the pricing question. The most-liked reply to the news was "So we have to pay a different API to check if text has a watermark?" — and the second-most-common objection was the mirror image, that a free unlimited checker is also a tool for iterating until the mark disappears. Announcing the API did not resolve that tension; it converted it from a design question into a pricing decision. We work through where the revenue in this actually sits in are AI watermarks monetisable?.

Two further confirmations from the same thread affect how you should read any future result:

• The model does not know it is watermarking. Asked whether the agent would be aware of the traces or whether it sits above the API response, the answer was "agent will not be aware," with Google's SynthID named as the reference implementation. You cannot ask Claude whether a passage is marked, and you cannot prompt the mark off.
• Robustness is explicitly limited. Asked whether it was easy to bypass: "yeah it's not perfect, you can edit it but it's a first step." Treat that as the vendor's own ceiling on the signal's strength — it is more candid than most policy pages, and it means a negative result carries essentially no information.

One claim from the announcement deserves pushback. The suggested use case — "you could check if a PR was generated by Claude Code" — is the weakest application of the technology, not the strongest. A PR description is prose and will carry the mark. The diff is low-entropy code where there are few equivalent token choices to encode a signal into, and a formatter pass rewrites what little remains. Anyone planning to screen contributions this way should wait for a published false-positive rate on code specifically before writing it into a policy.

Open questions still unanswered

• Will text-watermark detection be free, metered, or paid? Anthropic has said customers can use it themselves, which settles access but not cost. Unmetered access invites adversarial iteration (paraphrase until the mark disappears); paid or gated access puts a price on the transparency the Article 50(2) code was meant to guarantee.
• What's the false-positive rate, and at what passage length does confidence become reliable? No numbers published.
• Will older, pre-August-2 models ever get retroactive coverage? Anthropic calls this "in progress" with no date.
• Will detection be free? C2PA verification already is, via multiple independent tools. Text-watermark detection's cost model is unknown.

Bottom line

C2PA file verification is not a future feature — it's a working, free, already-deployed standard you can check today, and its main weakness is fragility (any re-save clears it), not unavailability. Claude's text watermark is the opposite: theoretically more robust against copy-paste, but with zero public detection tooling as of this writing. Until Anthropic ships that piece, "detecting a Claude watermark" mostly means waiting — and when it does ship, the more important habit to build now is treating any result, positive or negative, as a probabilistic signal rather than a verdict.

Related on explainx.ai

• A watermark removal tool just added OpenAI and Gemini support — the same C2PA-vs-statistical split, from the removal side
• Anthropic Is Watermarking Claude Text: What It Marks and What It Misses — the full policy announcement this post follows up on
• Will every AI model watermark its output? — which labs mark today, and why open weights break the scheme
• Are AI watermarks monetisable? — what the detection API is likely to cost, and who actually pays
• The case FOR AI watermarks — why a keyed signal beats the detectors it replaces
• What actually changes after the EU AI Act — the Article 50(2) obligation behind the forthcoming detection API
• How AI text watermarking actually works — the encoding and detection math
• Spotify labels AI artists — provenance signals becoming distribution decisions
• AI content detector — a basic, transparent style-signal check while Claude's actual watermark detector remains unavailable
• LinkedIn's C2PA Content Credentials for AI images — the same manifest standard deployed at platform scale
• LLM-generated text detection with classical ML — why probabilistic detection has always produced false positives
• EU AI Act and US policy: complete regulation guide — the Article 50(2) obligations behind this rollout
• Europe's AI landscape: sovereign compute and the EU Act
• Open-weight vs closed models: how to choose — the substitution path critics point to when they want output without a lab-level mark
• Claude Sonnet 5 pricing made permanent

Primary sources: Anthropic Help Center, "How Claude marks AI-generated content" (updated August 11, 2026) · EU AI Act Article 50(2) Code of Practice on Transparency of AI-Generated Content · C2PA specification · Content Credentials Verify (verify.contentauthenticity.org)

Accurate as of August 11, 2026. Anthropic had not published text-watermark detection tooling or technical documentation at the time of writing; statements about the token-watermarking mechanism describe the general published approach in watermarking literature, not a confirmed Anthropic implementation detail. This post does not provide instructions for removing, evading, or defeating watermark or C2PA provenance signals — for legitimate reuse of Claude-assisted content, see the repurposing guidance above. Follow @explainx_ai for updates.