Remove AI watermark from text

How it works

How to remove an AI watermark from text

If you pasted a draft from ChatGPT, Claude, or Gemini into email, Docs, or a website, invisible leftovers sometimes come along: hidden characters, “made with AI” tags, or a stamp on an image. AI Watermark Remover finds the marks it knows how to spot, shows a simple result, then removes them. It is not a magic “make anything undetectable” switch, and it does not prove a human wrote your text.

Why Anthropic, Google, Meta, and others mark output

Provenance is becoming a product requirement, not a research paper. Anthropic documents how Claude can attach machine-readable signals to generated content. Google ships SynthID-Text class sampling watermarks in Gemini research and related safeguards. OpenAI exposes provenance surfaces on some media. Open-weight stacks still circulate Kirchenbauer-style logit-bias watermarks. The policy story is disclosure: a downstream system should be able to tell that a string or file passed through a generator.

The implementation story is messier. There is no single “AI watermark.” There are edit-based Unicode carriers, statistical biases in which tokens get sampled, and container metadata (C2PA, XMP, EXIF, OOXML doc props). A tool that only blurs pixels, or only paraphrases, leaves two of those channels untouched. Conversely, stripping C2PA from a JPEG does nothing to SynthID-class marks in the pixels themselves.

If your job is hygiene on drafts you own — removing characters that break search, diffs, or paste; dropping generator YAML; clearing hard-bound Content Credentials before an internal archive — you need a layer map, not a magic eraser.

This is not guesswork, and it does not scramble sequences

A lot of “AI detectors” score prose style — burstiness, perplexity, how likely the next token looks. A lot of “removers” then paraphrase or shuffle sentences and hope a classifier blinks. That is speculation plus randomization. It is not what this tool does.

Detection walks the file for known watermark carriers: specific Unicode codepoints (zero-width space, bidi embeddings, tag characters, space homoglyphs), C2PA/JUMBF chunks and Content Credentials markers, and AI provenance keys in YAML, HTML, XMP, and document properties. If a listed mark is present, it is reported. Percentages are measured shares — how much of the input is those carriers, or whether a metadata channel is present (0% or 100%) — not a guessed “this is 73% AI.”

Removal deletes or rewrites those same matched carriers. Layer A drops the listed codepoints. The file cleaners drop the matched C2PA segments and AI metadata keys. The wording of your sentences is left alone unless you opt into a separate Layer B rewrite, which is optional, lossy, and explicitly not the detector.

Invisible Unicode, zero-width spaces, and bidi marks

The most common “ChatGPT watermark” or “Claude watermark” people actually trip over is not a secret detector score. It is invisible Unicode: U+200B zero-width space, U+200C/U+200D joiners, U+FEFF BOM, bidi embeddings (U+202A–U+202E), tag characters, and space homoglyphs such as U+00A0 or U+3000. They survive copy-paste. They make two visually identical strings compare unequal. They can flip layout in RTL-aware renderers. Search engines and code review tools treat them as real characters, so a “clean” sentence in the editor can still fail a byte-level diff, a translation memory match, or a CMS uniqueness check. That is why people type remove AI watermark from text long before they care about statistical detectors: the paste is already broken.

Layer A is deterministic. It inspects those codepoints, reports counts and offsets, then strips format characters and optionally maps exotic spaces back to U+0020. Optional flags — NFKC normalization and aggressive Latin/Cyrillic/fullwidth homoglyph mapping — are available in the Text and Markdown tabs. That work is verifiable: you can re-inspect and see the suspicious count drop to zero.

Layer A does not remove a statistical watermark. If the model biased token sampling, the words themselves still carry the signal. Unicode hygiene is still the right first move: it is lossless to meaning, it fixes real tooling bugs, and it is the only layer you can honestly call a clean.

Statistical watermarks (SynthID-Text class) and why rewrite is lossy

Modern LLM watermarks often hide in which tokens were chosen, not in extra characters. SynthID-Text (Dathathri et al., Nature 2024) and Kirchenbauer-style green-list sampling are the usual references. The signal is spread across the wording. Light edits barely move it. A serious attack is a heavy paraphrase: change clause order, connectors, sentence boundaries, and function words while keeping facts.

That is Layer B. Optional rewrite supports paraphrase, humanize, back-translation, structural outline-then-regen, and a code mode that rewrites comments and local identifiers. Hosted rewrite is off by default: it needs a non-origin model (do not rewrite Claude text with Claude if you are trying to avoid re-stamping), and it flattens voice. If you were going to paraphrase with a cheaper model anyway, you could have generated there in the first place.

No public tool can certify that an official vendor detector will fail. Until keys and detectors are public, Layer B is best-effort. This UI always says so.

C2PA, Content Credentials, EXIF, and document properties

Images and office files are a different channel. C2PA manifests (often in JPEG APP11 / JUMBF or PNG chunks) and XMP keys such as digitalSourceType or trainedAlgorithmicMedia record that a generator or editor touched the file. Markdown frontmatter may include generator: Claude or ai_generated: true. HTML can carry JSON-LD provenance and data-ai* attributes. DOCX stores customXml and core props. PDFs prefer exiftool for a real metadata strip.

The Images tab wraps PNG/JPEG cleaning, including a “keep non-AI metadata” flag that only drops C2PA/AI-looking segments. The Markdown tab runs the container cleaner so YAML AI keys fall out and the body still gets Layer A. Documents covers HTML, SVG, PDF, DOCX, and ODT, with automatic type detection.

Industry guidance treats provenance as two-layer: hard-bound C2PA you can strip from the container, and soft binding / imperceptible media watermarks that can re-link a remote manifest after metadata is gone. This tool strips the first. It does not claim the second.

How this AI watermark remover is wired

The page is a static site with an interactive tool. Detection and cleaning run on our API: inspect, clean, and optional rewrite. The article HTML is prerendered so search engines see the guide without waiting on JavaScript.

Default path: detect listed carriers with measured percentages, then strip those same marks. Optional rewrite for statistical sampling is a separate pass, not the detector. Reports split verifiable carrier matches from best-effort notes. Residual-risk copy is part of the result card, not a buried footer. Uploads go straight to the API (not through the static host) so large PDF and DOCX files are supported.

What this tool cannot do

Privacy, not theater

Use this on content you own or are authorized to process: local drafts, internal archives, engineering hygiene. Do not use it for academic fraud, to evade required disclosure, or to tell a platform a model never touched the file. A removed mark is not an origin story.

FAQ