How to remove a Claude text watermark: from-zero guide

You probably did not come here to study token sampling. You have a Claude-assisted draft built from your ideas and want wording that no longer depends on Claude's sentences.

The reason this project exists is equally practical: ideas should not carry watermarks. A synthetic image can impersonate a camera record of an event that never happened. Words carry ideas. Turning a statistical trace in their phrasing into a verdict about who formed the thought confuses sentence provenance with intellectual authorship.

That confusion hits hardest when writing assistance bridges a real gap between thought and transcription. Dyslexia, dysgraphia, motor limitations, cognitive fatigue and second-language writing do not make an idea less yours.

Here is the practical answer first.

For the simplest guided route: open Rewrite Room, paste the text, copy the prompt it builds, use that prompt in a model made by a company other than Anthropic, then bring the draft back for local checks. There is nothing to install.

For a short or sensitive text: use the manual fact-sheet method below. It costs your time and sends nothing anywhere.

If you do not want to send the prompt to another online service: keep the same Rewrite Room flow and let LM Studio or Ollama run the writer on your computer.

For repeated work with files: consider the CLI. It makes preparation and checks repeatable. It does not write, improve prose or find secret watermark positions.

Rewrite Room is not a hidden AI writer. It is a simple, direct prompt builder with local checks. The writing happens in the non-Anthropic model you choose.

The complete project is public and MIT licensed: Claude Watermark Toolkit on GitHub.

Pick your situation first

That is the complete practical map. There is no secret algorithmic method you must learn later. We also tested more complicated tools and removed them when they failed the release standard. If you saw an earlier version of the guide, the reason appears near the end.

The easiest route: Rewrite Room

What it is

Rewrite Room builds a more careful instruction than “paraphrase this”, then compares the answer with the source inside your browser tab.

It does not generate the answer. The writer can be an online model made by a company other than Anthropic or an open model installed on your computer.

What you do

1. Open Rewrite Room.
2. Paste the source text.
3. Select Prepare my rewrite prompt.
4. Copy the whole prompt.
5. Choose the writer: an online non-Anthropic model or a local model in LM Studio or Ollama.
6. Paste the prompt there as one message and send it.
7. Copy the draft back into Rewrite Room.
8. Select Restore exact values and check.
9. Fix missing facts, read for meaning and voice, then copy the restored draft.

That is the entire workflow.

“So Rewrite Room does not rewrite anything?”

Correct. It is a prompt builder with local checks. There is no model hidden in the page, which means:

• Rewrite Room uses no AI credits;
• the external model may use its free plan, subscription or credits;
• the source stays in the browser tab;
• you can download the repository and open the same page offline.

Another hosted provider may apply its own provenance system. A local open model avoids a hosted writing provider, but it requires a large download and suitable hardware. Use the Make my computer write section below or follow the complete local-model guide.

Why it masks dates, figures and quotes

Suppose the source contains €1,900.50. Rewrite Room temporarily replaces it with a marker such as [PV-01] before building the prompt.

The writing model keeps [PV-01]. When you paste the draft back, the page restores €1,900.50 character for character. The same mechanism covers dates, URLs, email addresses, quoted phrases and values you add yourself.

This does not prove semantic fidelity. It prevents a very ordinary class of errors while the wording changes.

What the final check means

The page shows:

• missing protected values;
• the longest phrase still shared with the source;
• surviving three-, four- and five-word sequences;
• repeated sentence openings;
• rough paragraph shape and length similarity.

It cannot tell you that Anthropic's private detector will accept the result. Nobody without the detector, key and threshold can certify that. These checks reveal lost values and wording that still depends heavily on the source. You must still review meaning, claims and voice.

The manual route: rebuild it yourself

“So the premium advice is to rewrite it. Duh.”

Yes. It belongs here because this guide includes every useful route, not only the routes that make a repository look clever. For a short text, manual rebuilding is free, private and often the strongest option.

The method is separation, not synonym replacement:

1. Read the source once.
2. On a blank page, record purpose, claims, evidence, qualifications and exact values.
3. Remove complete source sentences, except quotations that must remain exact.
4. Close the source.
5. Choose the order that helps the reader.
6. Write from the sheet.
7. Reopen the source only to check facts and qualifications.
8. Read aloud and remove sentences you would never say.

Open the complete manual method.

The source-free clean room

“Two envelopes sounds like overengineering.” For one paragraph, it probably is. Use the quick prompt or manual route.

The clean room is for work where stronger wording separation justifies one more checkpoint. Open Want more separation? Build without showing the old wording inside Rewrite Room.

You will fill two groups:

1. Meaning and facts: reader goal, atomic claims, evidence, qualifications and exact values.
2. Voice and limits: rhythm, formality, words to use or avoid, length and format.

The writing prompt contains those groups, never the source. The advantage is clear separation. The risk is equally clear: a bad brief can produce a beautifully original but inaccurate draft. Check the brief before writing and the draft afterward.

Follow the source-free method step by step.

I only want copyable prompts

Use the research prompt to create a structured brief. Check it against the source. Then open a completely separate context and use the drafting prompt with the brief only.

Two messages in one conversation are not two separate contexts. The drafting context must not see the source or the previous chat.

If you already work with software agents, the repository also contains an installable agent skill. If you do not know what a skill is, you are not missing a stronger method. It is the same workflow packaged for an agent runner.

Make my computer write the draft

“Local model” only means that the writing program runs on your computer instead of receiving the prompt on a company's server.

The route stays the same: Rewrite Room builds the prompt → the local model writes → you return the draft to Rewrite Room.

Use LM Studio if you want a graphical chat:

1. download LM Studio from its official website and install it;
2. use its internal search to download a model around 9 billion parameters, such as Qwen3.5 9B;
3. open the LM Studio chat;
4. paste the complete prompt from Rewrite Room;
5. copy the answer back into Rewrite Room for the check.

Use Ollama if you prefer a lighter terminal route. Download it from the official website, install it, open Terminal or PowerShell and run ollama run qwen3.5:9b. Paste the prompt when the input line appears. Avoid a model name ending in :cloud when you want writing to stay on your computer.

This is not free in a magical sense. It avoids hosted writing credits, but the model download uses several gigabytes and the run uses memory, battery and time. Below 16 GB of memory, begin with a smaller model and expect a greater risk of flattened voice or missing nuance. Stop after two bad drafts. A better model or a manual rewrite is worth more than repeating a weak one.

Follow the complete local guide from download to checked draft.

I want the local CLI

Pause here, because “use the CLI” explains almost nothing.

CLI means command-line interface. Here it is an optional program that reads plain text files. It does not write, install a model or locate watermark tokens. It earns its setup only when you repeat the workflow or want saved files and reports.

The normal loop is source.txt → the CLI creates prompt.txt → your writer creates draft.txt → the CLI checks draft.txt.

• You create source.txt in any text editor and paste the original draft into it.
• The first command creates prompt.txt.
• You create draft.txt and paste the writer's answer into it.

The CLI requires Node.js 20 or later. It does not install or call a writing model.

npm test
node bin/watermark-toolkit.js prompt source.txt --out prompt.txt
node bin/watermark-toolkit.js check source.txt draft.txt

The first command reads source.txt and creates the complete prompt. Open prompt.txt, copy it into the online or local writer and save the answer in draft.txt. The second command restores protected values and prints the checked draft plus a plain-language report. It never modifies the files. You still have to review claims, negations, qualifications, voice and invented facts.

Two optional controls remain. prepare previews the names, dates, numbers and quotations the toolkit plans to protect. compare places the same evidence side by side when you already have two or more drafts. It never chooses one for you.

Open the from-zero CLI guide with download steps and common failures.

For high-stakes text, hire an editor

The most radical plug-and-play option may be a person.

Give the editor the same checked sheet of facts, meaning, audience and voice. Ask for a new draft from that sheet. Show the source only at the end for factual comparison.

You are buying judgment. The costs are money, time and trust. Agree on confidentiality and deletion before sharing sensitive material.

Why there is no “more advanced” algorithmic route

If you have already encountered names such as SIRA, B4 or TSAPA and are wondering what to do with them, the answer is: nothing.

These research projects explore two useful questions: which parts of a text might be worth changing, and how to choose among many possible rewrites. We studied them, built targeting and candidate-search prototypes, then red-teamed the result.

• Local targeting could not know which positions Claude's private detector weighs. Its proxy also tended to highlight rare factual words and technical terms that should often stay untouched.
• The candidate tournament generated alternatives, but its feedback did not meaningfully guide the next generation. It looked more adaptive than it was.
• Repeated rewrite chains increased distance from the source while also accumulating factual and semantic drift.

Their useful contribution is already reflected in the decision not to sell you a complicated demo as an advanced solution.

The experiment protocol and toolkit red-team remain public for researchers. A method returns to the practical toolkit only if it earns a clear contract, repeatable test and understandable limit.

Why this project exists

An image can resemble a camera record of an event that never happened. Provenance can answer a concrete question there.

Words are symbolic carriers of ideas. A text may contain a false claim, plagiarism or manipulation, but it does not masquerade as sensory evidence. The harm lies in the claim, plagiarism or manipulation, not in the software that helped someone form a sentence.

The watermark itself does not make prose harder for a dyslexic reader. The problem begins when a school, employer or platform turns detectable assistance into a witch hunt.

Dyslexia, dysgraphia, motor limitations, cognitive fatigue and second-language writing can separate the quality of thought from the ease of transcription. Treating detectable help as automatic proof of dishonesty measures independent production of surface wording. It does not measure intellectual contribution.

This project does not oppose transparency. It argues that text watermarking can become a solution to the wrong problem. Fabricated sources, fraud, impersonation and spam need evidence, context and accountable people. A provenance score may open a careful question. It must not close it.

Read the full manifesto.

Is every Claude output already watermarked?

The public record does not support a clean yes or no.

Anthropic says supported models launched in the European Union from 2 August 2026 include marking at launch and that supported uses of those models are marked worldwide. It describes rollout for earlier models as ongoing and has not published a complete model-by-model coverage table.

So I would not claim that every Claude output has definitely been marked since 14 August. I would not claim that every older-model output is clean either. That level of certainty is not public.

How it works, without a statistics course

There are no hidden characters to remove.

While generating, a model selects a word or word-piece from several plausible options. The system Anthropic describes slightly biases those choices in a pattern tied to a private key. Someone with the key can look for that statistical pattern across the sequence.

Three practical consequences follow:

1. Punctuation edits and a few synonyms change too little.
2. Long text gives a detector more choices to observe than short text.
3. A new draft from facts and meaning creates a more independent sequence than cosmetic paraphrasing.

The private positions, threshold and complete model coverage remain unknown. That is why the toolkit measures observable surface evidence and never prints “watermark removed”.

Before you use the new draft

1. Check every name, number, date, URL and quotation.
2. Find claims that were not present in the source or brief.
3. Confirm that qualifications and uncertainty survived.
4. Read aloud and remove language that does not sound like you.
5. Choose the structure that helps the reader, not the one that merely lowers a metric.
6. Keep the brief and sources as an editorial record.
7. Accept responsibility for the final text.

The toolkit is for rebuilding your own ideas or material you have the right to edit. It cannot turn somebody else's work into yours, repair a false claim or cancel a clear contractual rule.