Watermarks Remover Hit 21,000 Stars in a Month and Its Core Claim Is Unverifiable
guillaumemeyer/watermarks-remover gained 21,018 stars in 27 days. It strips metadata and Unicode artifacts reliably. Its headline feature, removing statistical text watermarks from Claude output, cannot be independently verified because Anthropic has not released a public detector.
The WJS Desk
Sep 7, 2026 · 5 min read
On August 11, 2026, nine days after Anthropic began embedding invisible watermarks in every piece of text Claude produces, a Paris-based developer named Guillaume Meyer published a repository called watermarks-remover. As of this writing it has 21,018 stars, 2,419 forks, and 7 releases. That is roughly 780 stars per day for 27 consecutive days.
We read the source, the README, the releases, and three independent analyses. The tool does exactly what it says at two of its three layers. At the third, the one most people are starring it for, nobody can tell whether it works.
The Number That Made Us Look
21,018 stars in 27 days puts watermarks-remover in the top tier of open-source velocity this year. For context, anydoc (which we covered last week) hit 20,288 in a month. The difference is that anydoc converts documents. Watermarks-remover strips provenance marks from AI-generated content, and that distinction has made it one of the most discussed repos in the AI tooling space.
The contributor profile is narrow: 95 commits from guillaumemeyer, 62 from poorvith-mp, then a sharp drop to 12 each from two more, and single digits for the rest. Ten contributors total with meaningful commits.
What It Actually Does: Three Layers
The tool operates on three distinct layers, and understanding which is which matters because the verifiability is completely different:
| Layer | What It Strips | Can You Verify It? |
|---|---|---|
| Layer A: Unicode | Zero-width characters, exotic formatting, hidden Unicode | Yes, hex dump before/after |
| Layer C: Metadata | C2PA, EXIF, XMP, document properties | Yes, exiftool before/after |
| Layer B: Statistical | Token-sampling watermarks (Claude, Gemini/SynthID, OpenAI) | No public detector exists |
Layers A and C are straightforward engineering. Hidden Unicode characters are detectable with a hex editor. C2PA metadata is a standard format with open tooling. The repo handles both reliably, and we can verify that because the before and after states are observable.
Layer B is the one 21,000 people are hoping works. It rewrites text using a secondary language model to disrupt the statistical patterns that Anthropic embeds in Claude's token choices. The README is candid about the tradeoff: rewriting degrades text quality and flattens tone and voice. It also acknowledges that this layer "cannot certify vendor detectors will fail."
The Verification Problem
Anthropic announced text watermarking on August 2 to comply with the EU AI Act's Code of Practice on Transparency, which Anthropic and roughly 190 other signatories agreed to in July. The watermark works by subtly biasing token selection during generation, embedding a statistical signal that a detector can find but a human reader cannot see.
The catch: Anthropic has not released a public detector. Nobody outside Anthropic can run text through a verification tool and see whether the watermark is still present after cleaning. BleepingComputer reported that "none of the claims about defeating the text watermark can currently be checked."
Security researcher Pasquale Pillitteri took a different approach. Instead of testing detection, he read the code of several watermark removers and found that one popular text cleaner "let the most common hidden-payload technique through untouched." The hidden payload decoded back intact after the tool had supposedly cleaned the text. Pillitteri's analysis focused on the code itself, not the output, which is the only honest methodology when no detector is available.
What It Does Not Do
- It cannot prove it defeats Anthropic's statistical watermark. This is the central limitation and the README acknowledges it.
- It requires a secondary model for Layer B rewrites, which means you need API access to another language model to clean text from the first one. The cost and quality tradeoff is not trivial.
- It does not address visual watermarks on AI-generated images from tools like DALL-E or Midjourney. Those are pixel-level, not metadata.
- The Layer B rewrite "flattens tone and voice," per the README. If you used Claude because of how it writes, the cleaned version will not sound like Claude or like you.
The hidden cost: Layer B requires running your text through another language model. That model's output may itself carry watermarks from its own provider. The tool addresses this in the docs but does not solve it. You could end up replacing one watermark with another.
Who Made It and Does That Matter
Guillaume Meyer is a Paris-based entrepreneur. The repo is MIT-licensed, 1,596 KB of source, Python throughout. The release cadence has been aggressive: v0.5.0 on August 14 (3 days after creation), v0.6.0 on August 26, and v0.7.0 on September 3. Each release broadened format support and added tooling integrations including Docker, pre-commit hooks, and a Claude Code plugin.
The ethics section in the README is more thorough than most repos at this star count. It frames the tool as "for privacy and research on your content, not academic fraud or false human-written claims" and includes a liability disclaimer. Whether that framing holds up to how the tool is actually used is a different question.
The Context: Why People Are Angry
Anthropic's watermarking decision landed in a specific context. TechCrunch reported that some Claude subscribers cancelled over the feature, with users expressing concerns that content edited, proofread, or summarized with Claude could still be identified as AI-assisted. The objection is not always about hiding AI use. Some users argue that using Claude as an editor is not the same as using it as an author, and a blanket watermark does not distinguish between the two.
The star count on this repo is measuring that frustration as much as it is measuring confidence in the tool. The privacy argument has real weight. The technical execution on Layers A and C is solid. But the feature that made 21,000 people hit the star button is the one nobody can test.
Verdict
If you need to strip C2PA metadata or hidden Unicode from files you own, this tool works and you can verify it. If you are counting on it to defeat Anthropic's statistical text watermark, you are trusting a claim that neither the maintainer nor any independent researcher can currently test. Star it, bookmark it, but do not stake your reputation on Layer B until someone ships a detector you can run.
