# Claude text watermarks: what they mean and how to rewrite

[Original page](https://danilolapegna.com/guides/claude-text-watermark-guide.html)

Language: en. Content updated: 2026-10-16.

Rebuild a Claude-assisted text with Rewrite Room, a local model, a manual redraft or the CLI. Exact steps, costs and honest limits.


A text watermark is a statistical signal introduced during generation. It may indicate that Claude contributed to the wording; it does not establish who originated the idea. This guide shows how to rebuild a draft from essential information and check the result. **The toolkit cannot certify that a watermark is absent.**

Start with a text you have the right to work on and identify facts, figures and qualifications that must remain unchanged. Rewriting does not remove a duty to disclose AI assistance under applicable rules.

**For the simplest guided route:** open [Rewrite Room](https://danilolapegna.github.io/claude-watermark-toolkit/), paste the text, copy the prompt it builds, use that prompt in a model made by a company other than Anthropic, then bring the draft back for local checks. There is nothing to install.

**For a short or sensitive text:** use the manual fact-sheet method below. It costs your time and sends nothing anywhere.

**If you do not want to send the prompt to another online service:** keep the same Rewrite Room flow and let LM Studio or Ollama run the writer on your computer.

**For repeated work with files:** consider the CLI. It makes preparation and checks repeatable. It does not write, improve prose or find secret watermark positions.

Rewrite Room is not a hidden AI writer. **It is a simple, direct prompt builder with local checks.** The writing happens in the non-Anthropic model you choose.

The complete project is public and MIT licensed: [Claude Watermark Toolkit on GitHub](https://github.com/danilolapegna/claude-watermark-toolkit?utm_source=danilolapegna.com&utm_medium=guide&utm_campaign=claude-watermark-guide-en).

## Pick your situation first

| If you are thinking... | Start here | Time | What you actually get |
|---|---|---:|---|
| “The policy allows assistance and only asks for disclosure” | Do not rewrite automatically | 2 min | no unnecessary work or new errors |
| “Give me the simplest guided route” | [Rewrite Room](https://danilolapegna.github.io/claude-watermark-toolkit/) | 2-5 min, plus model time | a ready prompt and local checks on the new draft |
| “I do not want an online writer” | Rewrite Room with LM Studio or Ollama | one model download, then writing time | writing on your computer, with speed and quality tied to the hardware |
| “The text is short or private” | Manual rebuild from a fact sheet | 10-60 min | a new draft written by you without sending the source |
| “The writer must not see the old sentences” | Source-free clean room inside Rewrite Room | 15-40 min | a draft built from meaning and voice only |
| “I do this often or need local files” | Local CLI | a few minutes per text after setup | prompts, exact-value restoration and repeatable checks |
| “This is high stakes and I have a budget” | Human editor from the checked brief | paid time | editorial judgment and clear responsibility |

## The easiest route: Rewrite Room

### What it is

Rewrite Room builds a more careful instruction than “paraphrase this”, then compares the answer with the source inside your browser tab.

It does not generate the answer. The writer can be an online model made by a company other than Anthropic or an open model installed on your computer.

Before pasting the prompt into an online service, remember that you send its included content to that service. Markers are not anonymisation. Choose a manual rewrite or local model for material that must stay on your computer.

### What you do

1. Open [Rewrite Room](https://danilolapegna.github.io/claude-watermark-toolkit/).
2. Paste the source text.
3. Select **Prepare my rewrite prompt**.
4. Copy the whole prompt.
5. Choose the writer: an online non-Anthropic model or a local model in LM Studio or Ollama.
6. Paste the prompt there as one message and send it.
7. Copy the draft back into Rewrite Room.
8. Select **Restore exact values and check**.
9. Fix missing facts, read for meaning and voice, then copy the restored draft.

That is the entire workflow.

### Cost and data handling

Rewrite Room prepares and checks locally without AI credits. The writing model may use a free plan, a subscription or paid credits. You can also download the repository and open Rewrite Room offline; keep the writer local too if the whole process must stay on your computer.

### Why it masks dates, figures and quotes

Suppose the source contains **€1,900.50**. Rewrite Room temporarily replaces it with a marker such as **[PV-01]** before building the prompt.

The prompt tells the writing model to keep [PV-01]. If it does, the page restores **€1,900.50** character for character when you paste the draft back. The same mechanism covers dates, URLs, email addresses, quoted phrases and values you add yourself.

This does not prove semantic fidelity. It prevents a very ordinary class of errors while the wording changes.

### What the final check means

The page shows:

- Missing protected values;
- The longest phrase still shared with the source;
- Surviving three-, four- and five-word sequences;
- Repeated sentence openings;
- Rough paragraph shape and length similarity.

It cannot tell you that Anthropic's private-preview detector will accept the result. This public toolkit has no access to the API, and Anthropic has not disclosed its key or threshold. These checks reveal lost values and wording that still depends heavily on the source. You must still review meaning, claims and voice.

## The manual route: rebuild it yourself

For a short text, rewriting from a fact sheet is often the simplest route. It takes time and keeps the material on your computer.

The method is separation, not synonym replacement:

1. Read the source once.
2. On a blank page, record purpose, claims, evidence, qualifications and exact values.
3. Remove complete source sentences, except quotations that must remain exact.
4. Close the source.
5. Choose the order that helps the reader.
6. Write from the sheet.
7. Reopen the source only to check facts and qualifications.
8. Read aloud and remove sentences you would never say.

[Open the complete manual method](https://github.com/danilolapegna/claude-watermark-toolkit/blob/main/methods/human-redraft/README.md).

## The source-free clean room

For one short paragraph, a manual draft from a fact sheet may be simpler than preparing two separate briefs.

The clean room is for work where stronger wording separation justifies one more checkpoint. Open **Want more separation? Build without showing the old wording** inside Rewrite Room.

You will fill two groups:

1. **Meaning and facts:** reader goal, atomic claims, evidence, qualifications and exact values.
2. **Voice and limits:** rhythm, formality, words to use or avoid, length and format.

The writing prompt contains those groups, never the source. The advantage is clear separation. The risk is equally clear: a bad brief can produce a beautifully original but inaccurate draft. Check the brief before writing and the draft afterward.

[Follow the source-free method step by step](https://github.com/danilolapegna/claude-watermark-toolkit/blob/main/methods/two-envelope-clean-room/README.md).

## I only want copyable prompts

Use the [research prompt](https://github.com/danilolapegna/claude-watermark-toolkit/blob/main/prompts/en/research-pass.md) to create a structured brief. Check it against the source. Then open a completely separate context and use the [drafting prompt](https://github.com/danilolapegna/claude-watermark-toolkit/blob/main/prompts/en/drafting-pass.md) with the brief only.

Two messages in one conversation are not two separate contexts. The drafting context must not see the source or the previous chat.

If you already work with software agents, the repository also contains [an installable agent skill](https://github.com/danilolapegna/claude-watermark-toolkit/tree/main/skills/non-anthropic-text-rewrite). If you do not know what a skill is, you are not missing a stronger method. It is the same workflow packaged for an agent runner.

## Make my computer write the draft

“Local model” only means that the writing program runs on your computer instead of receiving the prompt on a company's server.

The route stays the same: **Rewrite Room builds the prompt → the local model writes → you return the draft to Rewrite Room.**

Use **LM Studio** if you want a graphical chat:

1. [Download LM Studio from its official website](https://lmstudio.ai/download) and install it;
2. Use its internal search to download a model around 9 billion parameters, such as Qwen3.5 9B;
3. Open Chat, select the downloaded model in the model loader and wait for it to load;
4. Paste the complete prompt from Rewrite Room;
5. Copy the answer back into Rewrite Room for the check.

Use **Ollama** if you prefer a lighter terminal route. [Download it from the official website](https://ollama.com/download), install it, open Terminal or PowerShell and run `ollama run qwen3.5:9b`. Paste the prompt when the input line appears. Avoid a model name ending in `:cloud` when you want writing to stay on your computer.

A local model avoids hosted writing credits, but the model download uses several gigabytes and the run uses memory, battery and time. Below 16 GB of memory, begin with a smaller model and expect a greater risk of flattened voice or missing nuance. Stop after two bad drafts. A better model or a manual rewrite is worth more than repeating a weak one.

[Follow the complete local guide from download to checked draft](https://github.com/danilolapegna/claude-watermark-toolkit/blob/main/methods/local-model/README.md).

## I want the local CLI

First check the requirements and prepare the files.

CLI means **command-line interface**. Here it is an optional program that reads plain text files. It does not write, install a model or locate watermark tokens. It earns its setup only when you repeat the workflow or want saved files and reports.

The normal loop is **source.txt → the CLI creates prompt.txt → your writer creates draft.txt → the CLI checks draft.txt**.

- You create `source.txt` in any text editor and paste the original draft into it.
- The first command creates `prompt.txt`.
- You create `draft.txt` and paste the writer's answer into it.

The CLI requires [Node.js 20 or later](https://nodejs.org/en/download). Download the repository ZIP from GitHub, extract it and open Terminal or PowerShell in the extracted folder. Put your plain-text source.txt file there. It does not install or call a writing model.

```bash
node bin/watermark-toolkit.js prompt source.txt --out prompt.txt
```

This command reads `source.txt` and creates the complete prompt. Open `prompt.txt`, copy it into the online or local writer and save the answer in `draft.txt`. After saving draft.txt in the same folder, run:

```bash
node bin/watermark-toolkit.js check source.txt draft.txt
```

This command restores protected values and prints the checked draft plus a plain-language report. It never modifies the files. You still have to review claims, negations, qualifications, voice and invented facts.

Two optional controls remain. `prepare` previews the names, dates, numbers and quotations the toolkit plans to protect. `compare` places the same evidence side by side when you already have two or more drafts. It never chooses one for you.

[Open the from-zero CLI guide with download steps and common failures](https://github.com/danilolapegna/claude-watermark-toolkit/blob/main/methods/semantic-reconstitution/README.md).

## For high-stakes text, hire an editor

An editor may be the right choice when the text needs judgement you do not want to delegate to a model.

Give the editor the same checked sheet of facts, meaning, audience and voice. Ask for a new draft from that sheet. Show the source only at the end for factual comparison.

You are buying judgment. The costs are money, time and trust. Agree on confidentiality and deletion before sharing sensitive material.

## Why there is no “more advanced” algorithmic route

If you have already encountered names such as SIRA, B4 or TSAPA and are wondering what to do with them, the answer is: nothing.

These research projects explore two useful questions: which parts of a text might be worth changing, and how to choose among many possible rewrites. We studied them, built targeting and candidate-search prototypes, then red-teamed the result.

- Local targeting could not know which positions Claude's private detector weighs. Its proxy also tended to highlight rare factual words and technical terms that should often stay untouched.
- The candidate tournament generated alternatives, but its feedback did not meaningfully guide the next generation. It looked more adaptive than it was.
- Repeated rewrite chains increased distance from the source while also accumulating factual and semantic drift.

These prototypes remain research. The practical routes above have clearer purposes and limits.

The [experiment protocol](https://github.com/danilolapegna/claude-watermark-toolkit/blob/main/research/experiment-protocol.md) and [toolkit red-team](https://github.com/danilolapegna/claude-watermark-toolkit/blob/main/REDTEAM.md) remain public for researchers. A method returns to the practical toolkit only if it earns a clear contract, repeatable test and understandable limit.

## Provenance and authorship

A signal about wording does not establish who originated an idea or prove a violation by itself. Interpret it alongside context, applicable rules and the work performed. The [project manifesto](https://github.com/danilolapegna/claude-watermark-toolkit/blob/main/MANIFESTO.md) develops that position.

## Is every Claude output already watermarked?

No. Anthropic publishes a model-by-model table. Check the row for your model and platform: the name “Claude” alone does not settle the question.

**Status checked on 8 October 2026.** The [current official table](https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content) distinguishes availability by model and platform, including rollouts still in progress. Check that combination before drawing conclusions about your text.

The detector API exists in private preview for eligible organizations. It is not a public checker, and this toolkit has no access to it. Anthropic still keeps the key, thresholds, error rates and detailed deployed configuration private.

One more limit matters: a listed model does not guarantee a detectable mark in every answer. Anthropic says the signal can be sparse in factual passages, code and light proofreading, and short text may not contain enough evidence.

## How it works, without a statistics course

There are no hidden characters to remove.

While generating, a model selects a word or word-piece from several plausible options. The system Anthropic describes slightly biases those choices in a pattern tied to a private key. Someone with the key can look for that statistical pattern across the sequence.

Three practical consequences follow:

1. Punctuation edits and a few synonyms change too little.
2. Long text gives a detector more choices to observe than short text.
3. A new draft from facts and meaning creates a more independent sequence than cosmetic paraphrasing.

The private positions, threshold, error rates and detailed detector configuration remain unknown. That is why the toolkit measures observable surface evidence and never prints “watermark removed”.

## Before you use the new draft

1. Check every name, number, date, URL and quotation.
2. Find claims that were not present in the source or brief.
3. Confirm that qualifications and uncertainty survived.
4. Read aloud and remove language that does not sound like you.
5. Choose the structure that helps the reader, not the one that merely lowers a metric.
6. Keep the brief and sources as an editorial record.
7. Accept responsibility for the final text.

The toolkit is for rebuilding your own ideas or material you have the right to edit. It cannot turn somebody else's work into yours, repair a false claim or cancel a clear contractual rule.


## Frequently asked questions

### Has every Claude output been watermarked since 14 August 2026?

No. The official table checked on 8 October 2026 distinguishes coverage by model and platform, including rollouts in progress. Check the combination you use before drawing conclusions about your text.

### Does Rewrite Room write the text or use AI credits?

No. It is a prompt builder with local checks. It builds the prompt in your browser and checks the draft you bring back. The non-Anthropic model you choose does the writing and may use its own plan or credits.

### Can hidden-character cleanup or punctuation edits remove it?

No. Anthropic describes a statistical token-choice signal rather than hidden characters. Light edits preserve much of the sequence a detector could evaluate.

### Does the toolkit guarantee removal against Claude's detector?

No. Anthropic offers a detection API in private preview, but this public toolkit has no access. The key, thresholds, error rates and deployed configuration remain undisclosed. The toolkit protects exact values and measures visible surface evidence without pretending to certify a detector result.

### Can the workflow stay entirely on my computer?

Yes. Rewrite Room can prepare and check offline. Run the writer in LM Studio or Ollama with a downloaded model, then bring the draft back. The toolkit does not silently install or start a model.

### Do LM Studio and Ollama use AI credits?

Not when you run a downloaded model on your computer. The download and run still use disk space, memory, battery and machine time. Avoid cloud model variants when you need local writing.

### Is there a more advanced algorithmic method I should use?

No. Papers called SIRA, B4 and TSAPA are research references, not reader steps. Targeting and tournament prototypes were removed because they failed the usefulness and reliability tests.

## Sources

[Anthropic: How Claude's text watermarking works](https://www.anthropic.com/news/claude-text-watermark)

[Anthropic Help Center: How Claude marks AI-generated content](https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content)

[EU AI Act, Regulation (EU) 2024/1689, Article 50](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32024R1689)

[Scalable watermarking for identifying large language model outputs](https://www.nature.com/articles/s41586-024-08025-4)

[Google DeepMind SynthID Text reference implementation](https://github.com/google-deepmind/synthid-text)

[SIRA: Self-information guided watermark removal](https://arxiv.org/abs/2505.05190)

[Watermark Smoothing Attacks](https://aclanthology.org/2025.findings-emnlp.264/)

[B4: black-box watermark scrubbing](https://aclanthology.org/2025.naacl-long.460/)

[TSAPA: multi-objective paraphrase attack](https://aclanthology.org/2026.findings-acl.459/)

[Chainwash: repeated independent rewriting](https://arxiv.org/abs/2605.05503)

[LM Studio: get started](https://lmstudio.ai/docs/app/basics)

[Ollama: quickstart](https://docs.ollama.com/quickstart)

[Ollama model library: Qwen3.5](https://ollama.com/library/qwen3.5)

This guide was built with AI tools and published under Danilo Lapegna's editorial responsibility. Its claims, sources and limits are recorded in the public project.