AI Text Watermarking, Explained Simply: How It Works and Who Can Actually Check It

Key Pointers

• The watermarking method of AI text employs algorithms processing and detecting patterns, thus rendering copying, pasting, or editing of the text in any text editing program meaningless in removing the watermark.
• Three laboratories, including Google with its SynthID-Text (since 2024), Anthropic (with Claude since August 2026), and OpenAI (with textGrain from 5 October 2026), have developed the watermark technology.
• OpenAI presently uses the watermarking method for ChatGPT and Codex only in the EU and does not use the watermark technology in the API.
• No individuals except those connected with research institutes are capable of recognizing the watermarking of the text, and SynthID Detector was launched on October 6, 2026, by Google to deal with videos, images, and audio documents and not texts.
• The watermark fades when a text is changed. One of the pieces of statistics provided by OpenAI states that in case 10% of words in a 400-token text are replaced by synonyms, the identification rate drops from 92% to 66%.
• Length is everything. A short answer doesn’t give enough space for the watermark to show up, which explains why, for instance, a 100-word post is almost impossible to verify.

What an AI text watermark actually is

Let’s clarify the most important misconception because most of the explanations regarding this topic that can be found online are incorrect.

The first thing that should be understood about text watermark is that it is not an invisible character present in your document. It is not an empty space, any special kind of hyphen, or information concealed in the document. It cannot be revealed by entering the document into the plain-text format and cannot be eliminated by rewriting the document.

The essence of the watermark can be explained as a statistical mark connected to vocabulary.

The language model constantly makes choices while writing. For instance, the phrase may be expressed in different ways in different contexts: “The change is huge”, “The change is significant”, “The changes is important”. With the help of its secret key, the laboratory ensures the necessary word choice is made. This process is carried out in each instance where the watermark is used.

If you want the fuller story of how detection arrived at this point, we’ve mapped it out in a brief history of AI text detection. This piece is about how the current generation works and what you can actually do about it.

How it works, step by step

Two approaches matter. They’re closely related, and the second one is what’s running in production today.

The green list, in plain terms

The original method came from John Kirchenbauer and colleagues at the University of Maryland in January 2023, in a paper called A Watermark for Large Language Models.

Picture it like this. Before the model picks each word, a secret key quietly splits the entire vocabulary in two: a “green” group and everything else. Which words land in green changes with every single position in the text, because the key reshuffles based on the words that came just before.

The model then gets a small nudge toward green words. Not forced. Nudged.

Over one word, that’s invisible. Over three hundred words, green words show up far more often than chance would ever allow, and a statistical test can say so with a real confidence value. The clever part: the detector never needs access to the model. It just needs the key and the text.

Tournament sampling, which is what Gemini actually runs

Google DeepMind took that idea further with SynthID-Text, published in Nature in October 2024.

Instead of one green group, it runs a knockout bracket. The model proposes a set of candidate words. The system seeds a random number from a hash of the previous four tokens plus the secret key, scores each candidate, then pairs them off like a tournament. Higher score advances. Each round uses a different scoring function, and the production setting runs 30 rounds.

The winner gets written. Then it does the whole thing again for the next word.

Here’s the figure that should reassure anyone worried this damages the writing: across roughly 20 million live Gemini responses, the difference in thumbs-up rate between watermarked and unwatermarked replies was 0.01%. Thumbs-down differed by 0.02%. Both statistically insignificant. A separate side-by-side study with 3,000 questions found no rater preference at all. The latency cost was 0.57% per token.

You cannot feel it. That’s the point.

Why length decides everything

Both methods lean on the same thing: the model needs genuine choice between words for the nudge to leave a trace. Researchers call this entropy.

Ask a model “what’s the capital of France?” and there’s exactly one sensible answer. No room to nudge, no watermark signal. Ask it to write three paragraphs on a novel and there are thousands of reasonable word choices at every step, so the pattern accumulates fast.

This is why a tweet can’t carry a usable watermark and a 2,000-word essay can. And it’s why OpenAI’s figures show detection climbing from about 80% on a 200-token passage to about 95% at 400 tokens, while math content performed substantially worse than psychology content across the board.

Short text and factual text are the blind spots. Not a bug anyone can patch. It’s the physics of the method.

Who is marking text right now

Provider	Marks text?	Where it applies	Can you check it?
Google (Gemini)	Yes, SynthID-Text, live since 2024	Gemini responses	No. The public SynthID Detector reads images, video and audio only
Anthropic (Claude)	Yes, since 11 August 2026	Worldwide, at the model level, for models launched on or after 2 August 2026	No. Private preview, by application
OpenAI (ChatGPT, Codex)	Yes, textGrain, since 5 October 2026	EU only for ChatGPT and Codex. API opt-in worldwide, off by default	No. Applications opened 5 Oct, for approved researchers and expert organisations
Meta, xAI, local open-source models	No published text watermark	—	No

Two things worth sitting with.

The geography is strange. OpenAI is rolling textGrain out in the European Union first and says it isn’t a global default at launch. Anthropic went the other way and applied Claude’s mark worldwide, at the model level, with no user switch. So a student in Dublin using ChatGPT produces marked text, the same student in Boston doesn’t, and both produce marked text if they switch to Claude.

Every lab now marks its text. Not one of them lets you read the mark.

So can you check a document for a watermark?

This is the question everyone actually arrives with, and you deserve a straight answer rather than a hopeful one.

For text: no. Not today, not for any of the three labs.

• Google’s SynthID Detector opened to the public on 6 October 2026 at synthid.com. Anyone can sign in and upload a file. It reads images, video and audio from Google, OpenAI, NVIDIA and Kakao. Text isn’t on the list, even though SynthID-Text has been running inside Gemini since 2024.
• OpenAI’s textGrain detector takes applications from approved researchers and expert organisations, case by case. OpenAI says plainly that it isn’t publicly available at launch, citing the risk of missed watermarks and false positives.
• Anthropic’s detection sits in private preview. Regulators, researchers, media, fact-checkers, educational organisations and EU civil society groups can apply. Educators are explicitly on the eligible list, so if you work at an institution it’s worth requesting access.

There is one thing you can check for free, and it gets confused with text watermarking constantly.

File authentication is another story. There is a mechanism called C2PA Content Credentials that creates the digital signature of files created using Claude. This system can be read using the free Content Checker from Anthropic but should not be confused with digital watermarks in a traditional sense, as conversion to another file type kills the credentials. It is also pertinent to note that those processes do not have anything to do with the words in a file and surely won’t help to detect ChatGPT watermarks. The sites claiming to do that are mostly looking for invisible Unicode characters, which is a real phenomenon happening in copied texts, but has nothing to do with digital watermarks of textGrain and SynthID or Claude.

Can watermarks be removed?

Weakened, reliably. And OpenAI published the numbers itself, which is unusually candid.

On a 400-token passage, at a 1% false positive rate:

What you do to the text	Detection rate
Nothing	about 92%
Replace 10% of words with synonyms	about 66%
Replace 25% of words with synonyms	about 17%

Translation and extensive editing worsen it. Google noted that SynthID-Text has this particular weakness when it reported in 2024 that while it withstands minor editing, it has trouble dealing with translation or rewriting. The paper from DeepMind also provides the list of known forms of attack: scrubbing, impersonation, and theft.

That is how every “humanizing tool” currently on the market does things. No magic. Just massive use of synonyms.

OpenAI quotes its conclusion perfectly: “Strong performance under ideal conditions does not guarantee reliability in real life.”

On the other hand, the same weakness allows a criminal to bypass the watermark but also makes the absence of the watermark itself meaningless. Anthropic claims this directly: absence of this sign could indicate the fact that the text has been translated, edited heavily, too short, generated by an earlier version of the software or simply comes from the provider that does not watermark the text. Not having a watermark does not mean that the text was written by a human; rather, it demonstrates that a person thinking this way does not understand how the situation works.

What this means if you’re a student

If you’ve been worrying that ChatGPT has been secretly tagging everything you’ve ever written, you can put that down. textGrain started on 5 October 2026, it’s EU-first, and OpenAI confirmed back in August 2024 that it had built a watermark and chosen to hold it back.

What’s genuinely worth knowing:

Nobody can check your work for a watermark right now. Not your professor, not your school, not an online tool claiming otherwise.

The thing that actually gets people flagged isn’t a watermark at all. It’s a statistical detector reading your writing style and returning a probability score. Those are the tools schools use, and they’re the source of every false-accusation story you’ve read. We’ve written honestly about AI detector false positives and about how these detectors work, including where they fall short.

Keep your drafts. Version history in Google Docs, outlines, notes, earlier versions. If a score ever gets pointed at you, process evidence is the strongest thing you can hand over, and it has been for years. This advice hasn’t changed and probably won’t.

If you want to see how your own writing reads before you submit it, running it through our free AI detector alongside a plagiarism check will show you what a reviewer is likely to see. Treat the number as information, not a verdict. Ours included.

What this means if you’re a teacher

The short version: watermarking does not solve your problem this semester, and planning around it would be a mistake.

Four things are all true at once.

Coverage has holes you could drive through. US ChatGPT output isn’t marked. API output isn’t marked by default. Older models aren’t marked. Any open-source model running on a laptop will never be marked by anyone.

You can’t read the mark anyway. If your institution qualifies, Anthropic lists educational organisations among eligible applicants for its preview, which is worth pursuing. But there’s no classroom-ready tool today.

Short assignments are structurally uncheckable. Discussion posts, short answers, anything under a couple of hundred words. Not enough signal.

Paraphrasing works, and students know it. The 17%-at-25%-replacement figure is public now.

So the things that worked before still work. Draft history. In-class writing samples you can compare against. A two-minute conversation about the argument a student supposedly made, which remains the single most reliable check anyone has found. If you want a view on where statistical detection genuinely helps and where it misleads, our look at detector accuracy and why some universities switched detection off are both worth your time.

Teachers managing a whole class can start with AI detection for teachers; students checking their own drafts should use AI detection for students.

Where this is heading

There are three developments to be concerned, all of which we have committed ourselves.

The date of 2 February 2027 is a relevant one. According to the EU AI Act, organizations must have a system for identifying watermarks by this date. If this comes true, the meaning of checking a watermark will change from a separate system per lab to a system that operates across different companies. This will cause an actual change in the work of teachers.

Access to detection should be broadened. The companies OpenAI and Anthropic announce that they plan to broaden their application, but the two companies claim that they proceed slowly because of the possibility of false positives which led to the failure of the statistical approach in the previous years.

It is expected that the two approaches will complement each other. The watermark will help to identify the model from which this passage is taken while the statistical method will allow understanding that the passage is machine-generated regardless of the tools that were used for that.

Frequently asked questions

Does ChatGPT watermark text?

Yes, the process started on the 5th of October 2026, however, this is limited to selected places. OpenAI’s textGrain has been introduced to render an undetectable statistic watermark to the ChatGPT and Codex output in the European Union and is expected to expand in the coming couple of weeks. The user has an option to enable this through API, which is completely disabled as a default user setting.

• In the European Union: watermarked output
• Outside the EU: no watermark
• Mark detection: only via application

How do AI text watermarks actually work?

Some words are chosen by the model. At each spot, the vocabulary list of terms is evaluated by a secret keyword which encourages the use of certain words, but not mandates them. The statistical sequence generated by this process can be identified by a detector with a key after a few hundred words.

• The choice of words indicates a method
• No letters, spaces, or data is added
• Detection requires the key and not the model

Can you remove an AI watermark?

You can diminish substantially. According to the data published by OpenAI, a 400-word passage detection rate drops from approximately 92% to 66%, with 10% of words replaced by synonyms. With 25% identical replacement, it falls down to a mere 17%. Besides, translation and extensive rewriting inhibit it even more. A very brief text does not signal enough to get traced.

• Percentage of words changed: 10% – detection reduced to about 66%
• Percentage of words changed: 25% – detection reduced to roughly 17%
• Short pieces may never give a detectable signal in the first place

Can I check my own text for an AI watermark?

Not at present. No public AI text watermark detectors have been made available by any companies. The SynthID Detector released on 6th October, 2026 only deals with video, image and audio but not text. Although OpenAI and Anthropic provide tech only for pre-approved people or organizations. Any supposed text detector uses Unicode characters instead of watermarks.

• Nothing available from any company
• SynthID does not deal with text
• Detection is of Unicode characters instead of watermarks

Is a missing watermark proof that a human wrote it?

Certainly; this is an error worth steering clear of. Anthropic says it simply: if there’s no watermark, it means that the document has either undergone substantial editing, has been translated, is too short to deliver a signal, belongs to an outdated model or was generated by a vendor that does not put watermarks on their products. Just because a watermark is absent does not mean that the author is someone from the human sphere; otherwise the logic is turned upside down.

• Without a watermark it doesn’t necessarily mean that there’s no AI.
• The fact a watermark was detected is not enough to prove anything.
• Provenance signals are always premises and not conclusions.

Does watermarking make the writing worse?

The existing findings indicate that there is no difference. Google has put SythID-Text through research which involved approximately 20 million live responses from Gemini and the results showed that the approval rating was 0.01% and the disapproval rating was 0.02%. A narrowed down study on 3,000 questions showed that no bias was found.

• There was no apparent quality difference in live tests
• The Latency cost was calculated to be 0.57% for each token
• The mark cannot be noticed by the readers

What is the difference between a watermark and Content Credentials?

A watermark is hidden in the words and does not get affected due to copy and paste. The Content Credentials which are based on the C2PA standard provide signed metadata attached to a PNG or JPEG file. Checking Credentials is simple but the information can easily get lost due to changes in format, saving or taking a screenshot. Anthropic has a free Content Checker that reads Credentials in files and does not read watermarks in the text.

• Watermark – in words, does not get affected by copy paste
• Content Credentials – in the files, gets easily removed
• A different tool is used for each one