Claude Watermark Remover - does it work?
12,000 GitHub stars. One fairly enormous problem.
Kyle Balmer
August 19, 2026
In partnership with
Write docs 4x faster. Without hating every second.
Nobody became a developer to write documentation. But the docs still need to get written — PRDs, README updates, architecture decisions, onboarding guides.
Wispr Flow lets you talk through it instead. Speak naturally about what the code does, how it works, and why you built it that way. Flow formats everything into clean, professional text you can paste into Notion, Confluence, or GitHub.
Used by engineering teams at OpenAI, Vercel, and Clay. 89% of messages sent with zero edits. Works system-wide on Mac, Windows, and iPhone.
Join my next live AI workshop
I'll show you how I turn fast-moving AI news (ahem chaos!) into workshops businesses actually pay for.
The new Claude watermark remover has passed 12,000 stars on GitHub.
Claude refuses to install it.
That's a bad look, Anthropic. And yes, objectively funny.
It also tells us almost nothing about whether the remover actually works….
There are a lot of viral posts right now pushing this detector. That comes from a place of not really understanding what’s happening here.
So don’t fall for it.
Nobody outside Anthropic can run the detector it claims to beat. So we currently have an arms race with no scoreboard. Lots of victory laps. No score.
Here's the full video walkthrough:
We finally know how the watermark works
Last week we knew Anthropic was rolling out Claude watermarks, but the technical detail was missing. That gap produced a few million extremely confident posts about hidden characters, secret user IDs and special spaces.
Anthropic has now confirmed the method. Claude uses a version of Google DeepMind's SynthID-Text. I thought it might be this but it’s good to have confirmation.
So there are no hidden characters. No user ID, company ID or chat ID. Claude does not sneak extra words into your paragraph. The mark lives in the choices Claude makes between words that were already reasonable options. Like Google’s SynthID.
Think of it as the same words with different dice. At any point Claude might have several sensible ways to finish a sentence. The watermark uses a secret key plus the preceding text to nudge which route it takes. And that route later can be deciphered bt a detector to show: yup Claude woz ‘ere.
The mark needs room to move
Because of how the watermark works one word or phrase choice proves bugger all. Across a long passage, the pattern can become strong enough for a detector to score.
The watermark needs space and time to “stick” - and it can only do so when there are lots of “high-entropy” (fancy term for equally plausible) choices it can make,
Creative prose gives Claude loads of valid choices. Translation does too. Lots of choices means lots of places to leave a statistical trace.
Code is tighter. Proofreading and extraction can be tighter still.
Anthropic's interactive explainer shows several examples and I recommend playing around with it:
Anthropic says internal testing found no effect on quality. Fine. We’ll see! I covered the earlier claims and unanswered questions in my Claude watermark FAQ.
The remover is really three tools
OK what about this viral “watermark remover”.
First up here it is if you want to download and use: https://github.com/guillaumemeyer/watermarks-remover
The GitHub repository is actually three different cleaners bundled together.
The first removes invisible Unicode characters, unusual spaces and similar text junk. Useful. Deterministic. Also irrelevant to Claude's announced statistical watermark. We know this is NOT what they are doing.
The second strips file metadata such as C2PA, EXIF and document properties. Again, useful. Again, a separate provenance layer. That’s cool but it’s always been easy to strip metadata.
We’re interested in the third and final attack. This focuses on statistical text watermarks by rewriting the text sentence by sentence. This is the Claude-relevant part. And it’s what everyone is getting (overly) excited about.
This is basically rewriting. Using a dumber model. Rewrite enough and sure the watermark degrades. But it’s a crude attack. There is no magic decoder. Another model replaces enough of Claude's original word choices that the statistical pattern may weaken or disappear. That’s…kinda it.
The repository's own explanation is admirably blunt about the cost. Guillaume literally points out that this is a bit pointless.
So...if a cheaper model has to rewrite every sentence anyway, why pay for Claude in the first place?
GREAT question. And one that people hyping this up aren’t asking. Despite the person who built the viral remover literally saying this. Most of the people celebrating it apparently did not make it that far down the README before rushing to Instagram.
Figures.
How to install the watermark remover?
Alright well how do we USE this.
If you are comfortable cloning the repo and deploying this yourself you can skip this obviously. This is for those who don’t know what any of that means.
You do not need to understand GitHub to try the tool.
Take this url https://github.com/guillaumemeyer/watermarks-remover and paste it into ChatGPT and say “yo chat set this up”.
Done.
Fun fact - try this with Claude and it’ll say nah. It’ll straight up refuse.
Pavol Luptak reported the same refusal, then loaded the skill with GLM 5.2 instead. ChatGPT and the Chinese models appear quite happy to help. Claude says it is going to pass.
Very funny. Terrible optics. And it makes this watermark remover seem more “dangerous” than it really is.
Still only an anecdote. It does not prove Anthropic has formally banned the repository, and it definitely does not prove the repository defeats Claude's watermark! In fact we have NO idea of its efficacy.
The test nobody can run
Heavy rewriting is a plausible attack. We know this about SynthID which has been around for years and is the basis of Anthropic’s watermarking system. Anthropic itself says changing every word can remove the mark while light editing probably will not.
So: does this work? How much editing do we need? When will a text show up as clear?
NOONE outside of Anthropic can answer this.
Because no one can score the result against Claude's private detector.
It’s like an archery contest in pitch darkness. People are firing arrows, hearing the occasional thump and declaring victory. Maybe they hit the target. Maybe they hit a tree. Maybe some poor guy retrieving arrows.
We don’t know. It’s dark.
When the sun comes up at dawn we’ll be able to see if we were on target. If we missed. Until then though we are blind.
Which means….until Anthropic releases the detector, anybody selling a guaranteed Claude watermark remover is guessing. Or lying. Or a bit of both.
For now, keep your drafts, sources and revision history. A shared AI vault gives you somewhere to keep that trail without turning it into a weekly admin project.
If you run a school, publisher or hiring process, treat a future detector score as evidence that Claude touched the text. It cannot tell you whether Claude wrote it, translated it or fixed somebody's punctuation. To believe so means you don’t understand the technology. I broke down the wider disclosure rules in my EU AI labelling guide.
To the Task,
Kyle