Claude's text watermark: what it carries, who can detect it, and whether it identifies you

The Morse teamPublished November 7, 20268 min read

The Claude watermark is an invisible statistical pattern in the words Claude chooses, and as of November 7, 2026, it's in the text of every Claude model Anthropic has launched since August 2, 2026, plus three older ones. Anthropic says it can't identify you: there's "nothing in the watermark, or its key, that would allow anyone to recover any information about the user, their organization, or their chats with Claude." Only organizations Anthropic approves, such as regulators, newsrooms, fact-checkers, and researchers, can check text for it today.

On November 7, 2026, we read Anthropic's own pages on the watermark: its August explainer, its help center article and model table, its developer docs, and its API release notes. We also read Article 50 of the EU AI Act, the European Commission's page on the code Anthropic signed, and Google's pages on SynthID Text, the method Anthropic built on. News sites reported on November 2 that four older models would get the watermark on November 3. Anthropic's own pages name three.

Anthropic deserves credit here. Its explainer lists the limits of its own watermark and answers the privacy question in one plain sentence.

Does Claude watermark its text?

Yes, for supported models. Anthropic's help center says that when a supported model generates text, "it weaves an imperceptible watermark directly into the text itself," and that "embedded watermarks will apply to all generated text by supported models." Anthropic explained it on August 14, 2026, in a post titled How Claude's text watermark works.

Nothing is added to what you read. The post says "nothing is added to the text and there are no hidden characters," and that the watermark uses no extra tokens, so it costs nothing more.

How does Claude's watermark work?

It changes where Claude's randomness comes from. When Claude picks the next word, it often has several equally good options, "overcast" or "grey" in Anthropic's example, and a random number settles the choice. With the watermark on, a secret key and the few words before settle it instead. Anyone holding the key can then check whether a passage's word choices match the key, and put a probability on Claude having written it.

Anthropic says its method "is a version of the SynthID-Text approach published by Google DeepMind" in a 2024 Nature paper. Google has open-sourced SynthID Text for developers and says the method "is less effective on factual responses," which Anthropic's own explainer echoes. Anthropic's key is its own, so its detector can't read a mark another company's model left.

Which Claude models carry the watermark?

Every model Anthropic has launched since August 2, 2026, and, as of November 7, three older ones on its own apps and API. Older models are being added in stages. Anthropic says the EU law gives models launched before August 2 a transition period.

News reports on November 2, among them GIGAZINE's, said an Anthropic email to customers listed four older models for November 3: Claude Mythos 5, Opus 4.7, Opus 4.6, and Sonnet 4.6. Anthropic's API release notes for November 3 name only three of them. Where each source stood on November 7, 2026:

Sources: the help center's model table and the release notes, read November 7, 2026. The table's other models with a text watermark, Claude Opus 4.8, Opus 5, Opus 5.5, Sonnet 5, Sonnet 5.5, Haiku 5.5, Fable 5, Fable 5.1, and Mythos 5.1, carry it on every platform listed.

The gap for Opus 4.6 has a reported explanation. The Decoder reported, in an update dated November 4, that a second Anthropic email moved Opus 4.6 to November 16, along with Opus 4.5, Sonnet 4.5, and Haiku 4.5. We found no such date on Anthropic's own pages, so treat it as reporting until Anthropic's table changes.

Can Claude's watermark identify you?

No, by Anthropic's account. Its explainer says watermarking "carries no identifying information and can't be traced to a specific person, organization, or chat," and that it "doesn't identify anything to do with individual users." Its developer docs say the same to people building on the API: the mark "carries no information about you or your organization."

Anthropic's description of the method bears that out: its key and the few words before settle each choice, and nothing about your account goes in. A detector that finds the mark learns that Claude likely wrote the words, and nothing about whose account asked for them.

What ties a Claude chat to you is your account. Every new Claude account starts with a verified phone number, and Anthropic keeps your chats on its servers under that account, with your email and, on paid plans, your payment details, as we cover in is Claude private. Those records are what connect a chat to you.

Who can detect Claude's watermark?

As of November 7, 2026, only approved organizations. Anthropic's help center says watermark detection "is currently in private preview," open to "regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, and EU civil society groups," plus companies that need to check their own Claude output under the AI Act. Others can ask through Anthropic's access request form, and Anthropic says it plans "to expand access to the detection API over time."

• Schools may get access. Educational organizations are on Anthropic's list, so a school could check an essay for Claude's mark once it's approved. Individuals aren't on the list as of November 7.
• Online AI detectors aren't checking for it. Anthropic says tools such as Pangram work differently "because the companies that provide it don't have our key." They look for phrasing habits instead.

What does a Claude watermark prove?

Only that Claude was likely involved. Anthropic says the key can only answer "What is the likelihood this was partly written by Claude?" and that a watermark "cannot distinguish 'Claude wrote this' from 'Claude heavily edited this.'" The help center adds that a detected mark "is not fully conclusive," since the text may have been changed, excerpted, or combined with other material afterward.

How much of the mark a passage carries depends on how much Claude chose:

• Proofreading leaves little. "The watermark only applies to words Claude chooses," Anthropic says, so text that's mostly yours, with Claude's grammar fixes, may not register.
• Translations carry it, "because in this case every word is chosen by Claude."
• Facts and code carry less. Where only one answer is right, such as a title or a line of code that would break, there's no free choice to mark. Code comments can carry it.
• Short passages are hard to judge. Confidence grows with length.

A missing mark proves little too. The help center lists text from a model that wasn't yet marked, very short passages, and heavy editing among the reasons Claude text can show no mark. It also lists text from Sonnet 4.6, and from Opus 4.6 once it's marked, made with some developer settings changed from their defaults.

Why is Anthropic watermarking Claude?

To comply with the EU AI Act. Article 50(2) says providers of AI systems that generate text "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated," and the Act applies from August 2, 2026. The same paragraph exempts AI systems "to the extent" they "perform an assistive function for standard editing."

Anthropic signed the EU's Code of Practice on Transparency of AI-Generated Content in July 2026. The European Commission puts the signatories at "about 190 organisations" and names Anthropic among them. The law is European, but the watermark applies everywhere. Anthropic says it's "applying watermarking globally at launch because we don't yet have a durable way to scope it by region."

Is Claude text from other apps watermarked?

If the app runs a supported Claude model, Anthropic's pages say yes. The help center says watermarking "will be applied at the model level, which means it will be present no matter which Claude product or surface the text comes from," and that marks cover the API, Claude, Claude Code, Claude Cowork, and Claude Tag, plus Claude on AWS, Google Cloud, and Microsoft Foundry.

What an app can change is who Anthropic sees asking. The mark says nothing about the user either way, so for any app that runs Claude, the privacy question is whether Anthropic knows it's you. Anthropic also tells companies that build on Claude to "independently assess what Article 50 requires" of their own products, so an app may have duties of its own.

How Morse keeps your name off your Claude chats

A watermark tells a detector that Claude wrote some words, but by Anthropic's account it can't say who asked. On Claude's own apps, your chats sit on Anthropic's servers under a verified phone number, an email, and whatever you pay with. Morse is built so Anthropic gets your question without your account.

• Anonymous, to use Claude without Anthropic knowing it's you. Morse's proxy removes your account, email, and IP address and sends your message under Morse's own account. Anthropic sees the question, without knowing it's you, and may keep it for a limited time to check for abuse, under its own policy. There's no Anthropic account and no phone number to verify. Morse strips who you are but not what you write, so leave out names and details you'd rather keep to yourself. Claude Haiku 5.5 comes with the Free plan, within 15 messages a day, and Claude Sonnet 5.5 with Pro.
• Private, for drafts you'd rather no host kept. It's the default for a new chat. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, run with zero data retention: Morse has zero data retention agreements with its inference, search, and other providers. Where a provider confirms that on each reply, Morse checks it and refuses a reply that doesn't.
• E2EE, for writing no one should read. Your browser checks the secure enclave's proof that it's genuine, then encrypts each message so only that enclave can open it, and Morse's servers relay text they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE runs open-weight models and comes with Pro, at $19 a month. Read how to verify an AI enclave's attestation.

In every mode, your chat history is stored only in your browser, encrypted, not on our servers. Morse doesn't train AI on your chats, sell your data, or show ads (privacy policy). Because we don't store chats, we usually have very little to give authorities. Clearing your browser or deleting your account deletes your chats for good, and we can't recover them, so keep a copy of any draft you need. For every route to Claude without an account, see how to use Claude anonymously, and for how Anthropic's own terms got here, our history of Anthropic's privacy policy.

Try a chat from the Morse home page without an account, or start free and use Claude Haiku 5.5 with no card.