Text Watermark Removers: Cleanup vs. Rewriting

A lot of advice about a text watermark remover assumes AI text contains a secret string of invisible characters you can delete. Usually it doesn't. Zero-width spaces, soft hyphens, right-to-left controls, and homoglyphs can appear after PDF extraction, translation, or copy-paste, but they're formatting debris, not proof of an AI watermark.

The job splits in two. Unicode cleanup removes invisible artifacts deterministically. Statistical rewriting changes wording patterns that may reflect how a model selected tokens. Treating them as the same job is how people end up with a tool that cleans text but never touches a probabilistic signal. Simple Unmark, discussed below, is our product.

Table of Contents

• Why Most Text Watermark Removers Solve the Wrong Problem
  • Two jobs, two levels of certainty
• How AI Text Watermarks Actually Work
  • Why the secret key matters
• Unicode Cleanup vs Statistical Rewriting
• The Paste Clean Scan Copy Workflow in Practice
  • One short session
• Matching Simple Unmark to Each Vendor Watermark
• Pricing Limits and Privacy by Design
  • What you trade with your text
• Ethics Legal Risk and Detector Honesty
  • Detector claims versus measured behavior
• What a Realistic Removal Workflow Looks Like
  • A defensible checklist

Why Most Text Watermark Removers Solve the Wrong Problem

A tool that promises to "strip the AI fingerprint" with one delete button is usually selling hygiene as watermark removal. If your pasted passage contains a zero-width space, a soft hyphen, a bidirectional override, or a lookalike character from a translation chain, character-level cleanup can remove it without changing the visible wording. Zero-width Unicode can still affect storage, tokenization, comparison, and display, so cleaning it is useful, just not for the reason many product pages claim. Security documentation on zero-width Unicode explains why these characters create mismatches between what people see and what software processes.

The distinction: hidden characters are something you can inspect and delete. A statistical watermark is a pattern you can only weaken, and detection remains probabilistic.

The harder signal sits in token choices. A generator can bias sampling toward particular options during decoding, creating a distributional pattern across the passage. That pattern isn't a visible mark, and it isn't stored as a special character. Rewriting the text can disturb it, but rewriting also changes the text itself and may produce a new pattern that another detector notices.

Two jobs, two levels of certainty

The practical split looks like this:

• Unicode cleanup: removes stray zero-width space U+200B, zero-width non-joiner U+200C, zero-width joiner U+200D, word joiner U+2060, soft hyphen U+00AD, bidirectional controls, unusual spacing, and related artifacts. A careful tool keeps joiners and direction controls where a script or emoji sequence needs them.
• Statistical rewriting: changes synonyms, syntax, sentence order, and phrasing to disturb token-choice patterns.
• Visible-marker removal: handles neither statistical watermarking nor the usual copy-paste debris unless the tool also cleans characters.

The first job is close to mechanical: scan the result again and confirm the characters are gone. Our free invisible character remover does that in the browser without changing your wording. The second job is a gamble against a detector whose key, threshold, and model version you don't have. General overviews such as remove watermarks with AI cover the wider topic, but no explainer can tell you whether a particular passage is marked.

How AI Text Watermarks Actually Work

Google's SynthID-Text is the clearest public example. (Anthropic describes Claude's watermark as a version of the same approach, and OpenAI's textGrain, announced for eligible ChatGPT and Codex text in the EU and offered to API customers as an opt-in that is off by default, also works through word choice.) During decoding, the system uses a secret-conditioned sampling method called Tournament sampling to bias token selection. The generated passage looks normal to a reader, while a detector with the relevant secret information can measure whether the sequence contains the expected statistical signal. The method was published in Nature and described as a production-ready watermarking system for large language model outputs. The SynthID-Text research paper documents the sampling approach.

Think of a coin that looks fair but is slightly biased. You can't prove much by watching a few flips, especially if you don't know which direction the bias points. A verifier that knows the mint's secret bias can evaluate many flips and decide whether the sequence looks ordinary or unusually consistent with that mint.

Text detection follows the same logic. The detector doesn't search for a phrase such as “generated by AI.” It scores token choices against a hidden rule and then applies a statistical decision boundary. SynthID-Text can return WATERMARKED, NOT_WATERMARKED, or UNCERTAIN, which is more honest than pretending every result is a binary fact. Google's SynthID documentation describes the three-way classification. For broader background, this survey of watermarking across text, visual and audio content covers the field's approaches and limitations.

Why the secret key matters

A detector needs the secret key used during generation, or access to a service that holds it. None of the three providers offers a general public checker for its own output: Google's public reference implementation is configuration-specific, OpenAI limits detector access to approved researchers and expert organizations, and Anthropic's detection API is in restricted private preview. A remover without that access can't truthfully say it has verified removal. It can rewrite the passage and may lower the chance of detection, which is different from proving the watermark is gone.

The underlying framework has two linked phases, embedding during generation and detection afterward. This review of watermarking-based AI text detection describes markers designed to remain invisible to people while remaining machine-detectable.

Detector behavior can change with model releases and implementation choices. Our guide to how AI text watermarks work explains why a "remove hidden characters" button can't address any of these schemes. A remover can change the evidence, but it can't promise a permanent escape from every future detector.

Unicode Cleanup vs Statistical Rewriting

These methods belong in the same workflow, not in the same category. Unicode cleanup is deterministic and inspectable. Statistical rewriting is an intervention that trades detector resistance against fidelity, tone, and technical precision.

Dimension	Unicode Cleanup	Statistical Rewriting
Target	Zero-width marks, soft hyphens, bidirectional controls, and unusual spaces; some tools also flag homoglyphs	Token-choice patterns and model-shaped phrasing
Text change	Can preserve visible wording	Changes wording, syntax, or sentence structure
Verification	Re-scan for the same character classes	Compare meaning, facts, terminology, and detector outcomes
Main failure	Does nothing when no hidden character exists	Can damage meaning or trigger another detector
Confidence	High for identified characters	Probabilistic and dependent on the detector
Best use	First pass for pasted or extracted text	Second pass when a statistical signal is the actual concern

Unicode cleanup should come first because it removes noise without forcing a rewrite. Zero-width space U+200B, zero-width non-joiner U+200C, and zero-width joiner U+200D are invisible when rendered, but they still influence how software stores and processes text. The Unicode security glossary gives the relevant technical context.

Statistical rewriting works differently. A system may replace a phrase, reorder a sentence, split a clause, or alter the rhythm of the prose. Those changes can weaken a watermark because they alter token distributions, but they can also drop a qualification, damage a proper noun, or make technical writing less precise. A technical comparison of hidden Unicode and AI watermark removal tools makes the important distinction between character scrubbing and higher-level rewriting.

Recommended order: clean first, rewrite only when there's a reason, then inspect the output manually and test it again.

A second pass isn't automatically better. More rewriting moves further from the source, and a detector may still return an uncertain or positive result. The question to ask is whether the output kept the information and intent you're accountable for.

The Paste Clean Scan Copy Workflow in Practice

A good workflow is predictable. Keep a backup of the original before touching it. Paste the passage into the tool and run the invisible-character pass first. The tool should identify or remove zero-width marks, soft hyphens, direction controls, and spacing anomalies without presenting those artifacts as the vendor's statistical watermark.

One short session

For a short passage:

1. Paste the source: Keep the original text available so you can compare wording, numbers, names, and claims.
2. Clean hidden artifacts: Remove characters that don't belong in ordinary copy.
3. Rewrite only if justified: Rewrite when you have a reason to address a possible statistical signal.
4. Review and copy: Re-scan for hidden characters, compare the result with the original, and copy the version you approve.

A good interface shows you the before and after. If a tool rewrites everything without letting you compare, you can't tell whether it only cleaned characters or changed the substance. Long inputs or complex tables may need to be split.

The re-scan confirms hidden characters are gone. It can't tell you anything about a statistical watermark, and a tool that shows a "residual watermark score" for Gemini, ChatGPT, or Claude text isn't measuring the provider's watermark unless it can show provider-approved detector access. Short passages carry too little signal for a stable decision anyway. Paste, clean, inspect, rewrite if needed, and check the copy you plan to use.

Matching Simple Unmark to Each Vendor Watermark

Simple Unmark has separate pages for Gemini/SynthID, ChatGPT, and Claude that explain what each provider documents. All of them use the same cleaner: Unicode cleanup followed by a full rewrite. There's no provider-specific rewriting mode and no access to any provider's detector.

Vendor	What the provider documents	What the cleaner does	What you can expect
Gemini	SynthID Text, a token-choice watermark, in production	Unicode cleanup, then a full rewrite	Google says thorough rewriting can greatly reduce detector confidence; its public reference implementation is configuration-specific, not a general Gemini checker
ChatGPT	textGrain, a word-choice watermark, for eligible ChatGPT and Codex text in the EU and as an off-by-default API opt-in	Same	Detector access is limited to approved researchers and expert organizations
Claude	A keyed, SynthID-style word-choice watermark documented by Anthropic for supported Claude models worldwide	Same	Anthropic says a complete rewrite removes it and light edits probably won't; its detection API is in restricted private preview

When Gemini is the known source, the SynthID page explains the mechanism. SynthID-Text embeds its signal during sampling, so removing invisible characters doesn't touch it. Research on paraphrasing, covered in the detector section below, shows why rewriting can weaken it and why no responsible tool should promise certainty.

None of the three providers uses hidden characters as its text watermark. Pages that advertise invisible-character cleanup as Claude or ChatGPT watermark removal are describing the wrong mechanism.

If you don't know the source, the process is the same: clean, rewrite only if there's a reason, and keep the original. A rewrite can make the passage less accurate without telling you which watermark, if any, was present.

Pricing Limits and Privacy by Design

Credit-based billing suits occasional cleanup, such as a single draft, a few client passages, or a periodic review, because you don't pay for months when you don't use the tool.

Simple Unmark charges 0.1 credit per started 100 words in Private mode and twice that in Confidential mode. Account cleans can contain up to 5,000 words, new accounts include 10 starter credits, and credits start at $5 with no expiry. Guests can run three free cleans of up to 100 words without an account. The invisible character remover is free and unlimited. None of this is a guarantee about detector outcomes.

What you trade with your text

Privacy deserves the same scrutiny as pricing. Simple Unmark doesn't store submitted text or output in its database or analytics, and account records track usage counts and credit activity. Payments are handled by Stripe. The rewrite does involve a third party: in Private mode, plaintext passes through the app and rewriting workload to the model provider DeepInfra. Confidential mode encrypts the text from your browser to the workload and bypasses the web backend, but DeepInfra still reads it to rewrite it. Confidential AI, a separate protected-GPU mode, is listed as coming soon and isn't available yet. Optional feedback can store cleaned output only if you choose to share it. Review the current terms before pasting confidential material.

For buying decisions:

• Occasional use: Credits avoid a recurring payment for sporadic cleanups.
• Sensitive content: Don't paste material unless the provider's retention and processing terms fit your obligations.
• Large drafts: Split work only when necessary, and preserve headings, tables, references, and terminology during review.

A low price doesn't buy verification. You're paying for cleanup and rewriting, not a legal or forensic statement that the output is human-written.

Ethics Legal Risk and Detector Honesty

Removing a watermark from text you're allowed to edit isn't the same as misrepresenting its origin. Rewriting your own AI-assisted draft may be acceptable under one policy and prohibited under another. Submitting the result as entirely human-written when an academic rule, client contract, publisher policy, or workplace requirement forbids that claim creates a risk.

Copyright and disclosure are separate questions. A short AI-assisted passage may raise limited copyright concerns, while a false statement about authorship can breach institutional or contractual terms. Preserve the source, record how AI was used, review the output yourself, and disclose assistance when the applicable policy requires it.

Detector claims versus measured behavior

Detector	How results are reported	Behavior after rewrites	Documented failure mode
SynthID-Text	Statistical classification, not certainty	Meaning-preserving paraphrase can sharply reduce detection	False positives and uncertain results
KGW	Watermark score based on token preferences	Meaning-preserving paraphrase can remove detection in tested text	Signal depends on the secret key and threshold
Unigram	Statistical watermark score	Meaning-preserving paraphrase can remove detection in tested text	Rewriting changes both evidence and text quality
General AI detectors	Often presented as authorship indicators	Scores can shift after editing	A score doesn't prove who wrote a passage

A July 2026 evaluation found that paraphrasing by a small open model removed detection in all initially detected KGW and Unigram texts and in 58 of 59 SynthID texts (98.3%). The SynthID configuration also flagged 5.4% of paraphrased human-written controls as AI-generated. The tests used 50-token texts and the open-source MarkLLM implementation of SynthID, not Google's production system. The published evaluation supports a narrow conclusion, not a universal promise: paraphrasing can weaken tested watermark signals, while detection can still misclassify human-written text.

Compliance rule: never use a detector result as your only proof of origin, and never use a remover as proof that disclosure rules no longer apply.

Simple Unmark doesn't guarantee detector evasion and shouldn't be used to misrepresent authorship. It removes hidden characters and rewrites wording, which may weaken a probabilistic signal. You remain responsible for labeling the content, checking facts, protecting confidential material, and following the policy that governs its use.

What a Realistic Removal Workflow Looks Like

Start with the source. Save the original passage, note whether it came from Gemini, ChatGPT, Claude, or an unknown tool, and record any detector output that caused concern. That gives you something to compare after editing and keeps a trail you may need later.

Run the invisible-character scan first; that's the part you can verify. If you rewrite, review the output for facts, numbers, proper nouns, tone, citations, and intent. A guide to how to remove AI watermarks from text can help organize those steps, but it can't replace your own review.

A defensible checklist

• Back up the original: Keep an untouched copy with its source and date.
• Note the source: Record whether the text came from Gemini, ChatGPT, Claude, or an unknown tool, and check what that provider documents.
• Clean Unicode first: Remove zero-width marks, direction controls, and spacing debris.
• Review the rewrite: Compare claims, terminology, names, numbers, and meaning.
• Don't over-read detectors: Classifier scores are style estimates; no general public tool checks provider watermarks.
• Document the limitation: Record that rewriting isn't proof of removal.
• Apply the policy: Disclose AI assistance when a contract, institution, or publisher requires it.

Unicode cleanup produces plain, copy-safe text and can be checked directly. Statistical rewriting may weaken a token-pattern signal, but it also changes the passage, and a detector may still be uncertain or positive. A careful workflow gives you cleaner text, documented choices, and a record of what happened.