What We Cannot Remove

The rule that decides everything

A mark can be removed locally when it is stored beside the content. It cannot be removed locally when it is stored in the content.

Hidden characters and file metadata sit beside the content: they are separate bytes with their own place in the file, so they can be found exactly, removed exactly, and verified by reading the result back. Statistical text watermarks and pixel watermarks are the content, expressed slightly differently. There is nothing to delete, only something to overwrite, and overwriting it means rewriting the text or degrading the image.

That single distinction explains every entry on this page.

Statistical text watermarks

Claude's mark and Google's SynthID Text both work by nudging word choice with a secret key. Anthropic's own description is the clearest available: "Nothing is added to the text and there are no hidden characters."

Two consequences follow.

There is nothing for a cleaner to find. A scanner that reports zero hidden characters has said nothing at all about the statistical mark, because it never looked at it and could not have.

There is nothing to verify against. Anthropic's detection API has been announced without a date, and Google's text detector portal is waitlist-only. So even a genuine rewrite cannot be confirmed to have worked, by anyone outside those companies.

What does affect the mark is exactly what Anthropic published: light editing probably will not remove it, and a complete rewrite where every word is replaced will. Everything in between is a curve with no published threshold, and any tool quoting a percentage invented it.

Pixel watermarks

SynthID Image lives in the pixel values of a generated picture. It is designed to survive the things people assume will remove a watermark: screenshots, JPEG re-encoding, resizing, cropping.

DetectMark can re-encode an image, and re-encoding is part of how the metadata cleanup works for JPEG, WebP and AVIF. That process does not target the pixel mark and there is no reason to believe it removes it. The export receipt always lists possible pixel-level watermark signals under NOT REMOVED, with the note that stripping metadata does not remove watermarks encoded in the pixels.

Verification for pixel marks currently runs through Google Search surfaces and a Chrome rollout. That is a consumer-facing check, and it is not something a third-party browser tool can call.

Audio and video

DetectMark does not scan audio or video files at all. Every check on those formats reports Unsupported rather than Unknown, because the distinction matters: Unknown means a check exists and could not resolve, Unsupported means no check was run. See the status page for the definition of every label used there.

Lookalike characters

This one is a deliberate limit rather than a technical one. A Cyrillic а and a Latin a are different characters that draw the same shape. Substituting one for the other silently would change the text, and there is no safe automatic direction to substitute in, since either character may be the intended one.

So lookalikes are reported with their positions and never removed automatically. That is a choice to leave evidence in place rather than to quietly edit someone's document.

What removal claims should sound like

An honest removal claim names the thing removed, says where it lived, and reports a verification. "Removed 3 zero-width characters and 1 clipboard artifact, confirmed by re-scanning the cleaned text" is a claim you can check.

"AI watermark removed" is not a claim, because it does not say which watermark, where it was, or how anyone knows. When you see it, the useful question is always the same one: what did the tool actually look at?

What can be removed

For completeness, the other side of the ledger:

• Hidden characters in text: the zero-width family, stray spacing characters, format and bidi controls.
• Clipboard artifacts: the class names and attributes a rich-text paste carries.
• Image metadata: EXIF, GPS, device identifiers, XMP, PNG text chunks including generation prompts, and C2PA manifests.

Every one of those is verified by scanning the cleaned output before the receipt is written. Nothing appears under REMOVED that a second scan did not confirm.