Last week Anthropic explained Claude’s text watermark in public: nothing is injected into the string. The signal lives in which words get chosen. A few days later, Chinese tech media ran a louder headline — Claude’s watermark had become worthless paper overnight.
The piece pointed at a GitHub project, watermarks-remover. The 36Kr reprint on 17 August 2026 (from the WeChat account 新智元) said it had picked up about 11,000 stars in a few days, shipped under MIT, and could clear Claude, Google’s SynthID-Text, and C2PA data sitting in files. It sounded like a final weapon.
What you actually need is smaller and more useful: which layer it strips. Then you can decide whether your draft needs a character clean, a full rewrite, or should be left alone.
The headline says “worthless paper.” The author does not.
The media story is a moat getting smashed. The repository is not written that way.
Guillaume Meyer is explicit. Unicode cleanup is countable and re-checkable. The pass that goes after statistical sampling watermarks is best-effort. Until vendors publish detectors and keys, no tool can honestly certify that an official check will fail.
That is a boundary, not modesty. Anthropic’s verification API is still not open to third parties. Without that key, “we verified removal” is a guess.
The useful part of the viral coverage is not the word “cracked.” It is that the project finally separates jobs people keep gluing together.
It is three jobs, not one watermark
Treat the repo as a single “remove watermark” button and you will use the wrong layer.
Layer one: strip invisible characters. Zero-width spaces, odd blanks, bidirectional controls, tag characters. These are real code points in the string. Delete them and they are gone; meaning does not change. The U+202F narrow no-break space that often rides along when you copy from ChatGPT’s web UI belongs here. It is paste residue, not Claude’s official watermark. We unpacked that path in the ChatGPT paste piece.
Layer two: rewrite with another model. Anthropic has said the same thing the repo stresses: light edits usually leave the statistical trail. You need to change a large share of the wording, sentence by sentence — not shuffle sections or retitle headings. The project’s move is to send the prose through a non-origin model (local Llama, not Claude again) and say the same thing in different words. That breaks the original sampling pattern. It also replaces the voice.
Layer three: peel file metadata. C2PA, EXIF, and document properties in PNG, JPEG, PDF, Word. Those are labels on the container, not a statistical watermark in the sentences. Pixel-domain image marks (signal baked into the picture) are a different problem again; the repo keeps that behind optional, heavy backends.
Think of laundry. Layer one shakes coins out of a pocket — you can see them and count them. Layer two unravels the garment and weaves another one that still looks like a shirt; the threads are new. Layer three snips the tag off the collar. All three can be called “removing a mark.” You cannot treat woven-in thread as if it were pocket change.
What to do with the text in front of you
Do not install a Python service first. Decide which layer you are in.
| What you actually have | Repo layer | What to do on the web | Does a free scan help? |
|---|---|---|---|
| Weird spaces, broken search, CMS complaining about hidden characters after a ChatGPT / browser paste | Unicode clean | Invisible character tool — about 60 code points, local | Yes. Find them, delete them. |
Leftover **bold** and heading hashes | Not a watermark — Markdown | Markdown tab on the home page | Yes |
| A long Claude draft from after August 2026, official statistical watermark | Sentence-level rewrite | Pro Text Watermark Remover — another model rebuilds the meaning | No. There are no characters to find. |
| You only want a different tone | The repo’s “humanize” prompt — not the main watermark path | AI Humanizer | Irrelevant |
| C2PA / EXIF on a PDF or image | File layer | Out of scope here | Irrelevant |
| Passing Turnitin, GPTZero, or Pangram | Nobody can promise this | Do not buy any tool for that claim | Irrelevant |
Shorter:
- The free scan finds invisible characters → clean those first. That job finishes today.
- The scan finds zero, and the draft is mostly Claude’s long prose → character tools will not help. The path Anthropic describes is a full wording rewrite.
- Voice matters more than hygiene → stay on layer one. Do not force a rewrite.
- You are going to rewrite anyway → do not send Claude text back through Claude. You can restamp the same kind of signal.
We already walked through the sampling mechanism in the official-watermark explainer. The line to keep is this: the official mark adds nothing you can delete; a free scan that finds nothing does not mean the mark is absent, and it does not mean it is gone. The detector page lists Unicode and formatting residue. It is not Anthropic’s key check, and it will not give you a “percent AI” score.
A rewrite can scramble the statistics. It also replaces the writing.
The README has a paragraph that recaps almost never quote. Statistical marks live in the wording. Almost every sentence carries a little of the signal. Moving sections, changing headings, or touching up a few adjectives barely moves it. Clearing it means rewriting sentence by sentence. After that, the voice belongs to the rewrite model. The author then asks an unkind, honest question: if you were going to run the draft through a cheaper model anyway, why pay the premium model in the first place?
That question applies here too. Pro reconstruction is the same technical road: a different model chooses the words again while keeping the meaning. It matches what Anthropic describes as a complete rewrite. It is not a certificate that an official detector failed. That detector is not public. We will not issue a “verified removed” badge.
There is a real cost. Terms get softer. Rhythm changes. Sentences you tuned get flattened. Use this when you need the thinking and the facts, and the wording can be said again. Skip it when this exact sentence is the product.
Do not let eleven thousand stars pick the tool
The star count is a mood, not a proof. People are angry that a paid product stamps output globally with no off switch. The anger is real. The engineering limits are real too.
The repo is useful if you live in a terminal: local scripts, an agent skill, a long list of file formats. It is not a shorter path if you only want to paste a paragraph in a browser. You would stand up a Python service for work that is mostly about PDFs and images, not web prose.
We are not wiring that project into this site. Character cleanup stays free and local. Statistical marks still go through a paid reconstruction. Keep three mechanisms apart: ChatGPT paste residue, Gemini’s own leftovers, and Claude’s official statistical watermark. Different machinery, different tools.
Next time a headline says the watermark died overnight, ask which layer died: the coins in the pocket, or the thread in the cloth. If you can answer that, you will not pick the wrong tool.
AI Text Watermark Remover is an independent third-party tool. It is not affiliated with Anthropic, OpenAI, or Google.
Sources: Anthropic, How Claude’s text watermark works, 14 August 2026; Guillaume Meyer, watermarks-remover; 36Kr reprint of 新智元, 17 August 2026
