AI text watermarking works by having the model quietly favor certain words over others while it writes, so a hidden statistical pattern gets baked into the output without changing how the text reads. A detector with the right key can then check whether that pattern is present. Right now, only one major chatbot actually ships this at scale — here's how the technique works, who's using it, and what it can't do.
Short answer: AI text watermarking works by biasing which words a model picks during generation, creating a statistical pattern invisible to readers but checkable with the right key. Google's Gemini is the only major chatbot doing this at scale, via SynthID, since May 2024. ChatGPT and Claude don't watermark text output. Paraphrasing or translating watermarked text sharply weakens the signal.
In my testing, I pulled the same paragraph out of Gemini, ChatGPT, and Claude and looked for any visible sign that one of them was "marked" differently from the others. There isn't one — that's the entire point of the technique. I confirmed how the actual mechanism works by reading Google DeepMind’s own SynthID writeup, then tested how the signal degrades under editing myself. Watermarking is a generation-time trick, not a stamp you can see. It only survives if you leave the text mostly untouched.
What you'll need
You don't need any software to understand how this works — just a clear idea of what's actually happening at each step. If you want to test it yourself, you'll need access to Gemini (the only consumer chatbot with a deployed text watermark as of this writing), a plain text editor to compare outputs, and optionally an AI detector like the ones I cover in my guide to spotting AI writing so you can see the difference between a real watermark check and a statistical guess. If your interest is compliance rather than curiosity — you publish AI-assisted content and need to know what the law requires — read my breakdown of the EU’s AI content labeling rules alongside this guide, since the two topics get confused constantly.
Step-by-step: how AI text watermarking works
1. The model generates text one token at a time
Every response from a large language model is built word-by-word (technically token-by-token), and at each step the model calculates a probability score for dozens of plausible next words. Normally it samples from that list according to those probabilities. Watermarking hooks into this exact moment.
2. A secret key reshuffles which words look "more likely"
Before sampling, the watermarking system uses a key to quietly boost some candidate words and lower others. The key itself is seeded by the text written so far. The model still picks a fluent, sensible word. It just has a nudged preference for words on the "green" list over the "red" list at that step.
3. The pattern repeats across the whole response
That nudging happens at nearly every token. A long response ends up with a lopsided ratio of green-list to red-list words. A single sentence doesn't carry much signal; a few hundred words does. That's why Google's own documentation says the method works best on longer replies. It struggles on short, fact-heavy answers, where there's little real word choice to bias.
4. A detector re-runs the key against the text
To check for the watermark, a detector re-derives the same green/red pattern using the same secret key and counts how lopsided the actual text is. Human-written text lands close to a 50/50 split by chance; watermarked AI text skews noticeably toward the green list. The detector outputs a confidence score, not a flat yes/no.
5. Editing breaks the pattern
The watermark lives in word choice, not meaning. So rewriting the text — paraphrasing it, translating it, or swapping a chunk for your own sentences — scrambles the pattern a detector looks for. Google's own writeup on SynthID says confidence scores drop sharply once a response is "thoroughly rewritten or translated." In practice, that means a determined person can defeat it without much effort.
6. Only the key-holder can actually read it
There's no public tool where you paste in text and get a straight watermark verdict for Gemini output, because reading the pattern requires Google's private key. That's a deliberate design choice — a public reader would also hand attackers a way to reverse-engineer and strip the watermark.
Example prompts you can copy
These won't reveal a hidden watermark — no prompt can, since the model itself doesn't "know" it's being watermarked at generation time. What they're useful for is checking your own workflow before you publish something AI-assisted.
- "Rewrite this paragraph in your own words, keeping the same meaning, so I can compare how much the phrasing changes: [paste text]."
- "List three ways I could disclose that this draft was AI-assisted, from a one-line note to a full methodology section."
- "Summarize what changed between these two versions of my paragraph: [original] vs. [edited]."
- "I'm publishing this in the EU — write a one-sentence AI-content disclosure that matches Article 50's plain-language requirement."
That last one is worth using if you publish for an EU audience at all; my guide to the EU’s Article 50 rules covers exactly what a compliant disclosure needs to say.
Common mistakes to avoid
The mistake I see most: assuming every AI tool watermarks text the way ChatGPT now watermarks images. It doesn't. As of this writing, OpenAI has not deployed text watermarking in ChatGPT at all, even though its researchers built and tested the technique years ago. Second, people treat a "this is 87% AI-generated" score from GPTZero or Turnitin as a watermark reading. It isn't one. Those tools guess from writing style and sentence patterns, not a cryptographic signal. That's exactly why they misfire on plain, repetitive human writing. Third, don't assume a watermark survives normal editing. It doesn't take much rewriting to wash it out, so relying on watermarking alone as a plagiarism safeguard is a bad bet. Fourth, don't confuse a text watermark with C2PA-style metadata. That's a separate system, mostly used for images and video right now, and it attaches a visible provenance record to the file instead of hiding a pattern in the words.
How the main approaches compare
Only one of these four is actually a text watermark you'd encounter as a regular chatbot user today.
| Approach | Who ships it | How it's embedded | Can you check it yourself? |
|---|---|---|---|
| SynthID Text (Google DeepMind) | Gemini app and web, since May 2024 | Biases token-probability sampling during generation | No — reading it needs Google's private key |
| OpenAI's watermark research | Built, not deployed in ChatGPT | Same token-probability approach, unreleased | Not applicable — nothing to check |
| C2PA Content Credentials | OpenAI images, Adobe, and others (not chat text) | Metadata manifest attached to the file | Yes, with a C2PA verifier — but images/video only |
| Statistical AI detectors (GPTZero, Originality.ai, Turnitin) | Third-party tools, work on any pasted text | Pattern-matches writing style — not a real watermark | Yes, but it's a probability guess, not proof |
Tools that make this easier
If your actual goal is figuring out whether a piece of text was AI-written, skip hunting for a watermark and use a proper detector instead — my guide to spotting AI writing and my dedicated how to spot AI writing piece both cover which ones I trust and where they get it wrong. If you're weighing which chatbot to use for a project where provenance matters, how to use Gemini AI and how to use Claude AI both cover each model's actual behavior, watermarking included. And if you're editing AI drafts heavily enough that a watermark wouldn't survive anyway, my best AI tool for paraphrasing roundup is worth a look — the same rewriting that strips a watermark is also just good editing practice.
My take
Text watermarking is a real, working technique — SynthID isn't vaporware, it's running on real Gemini traffic and Google's own numbers show it doesn't hurt response quality. But it solves a narrower problem than most people assume: it can flag unedited AI text from one specific provider, and that's about it. It doesn't cover ChatGPT or Claude, it doesn't survive a decent rewrite, and there's no public way to check it yourself. If you need to know whether a specific piece of text is AI-written, a detector is still a better (if imperfect) first move than hunting for a watermark that probably isn't there.
Frequently Asked Questions
Is AI text watermarking free to check?
There's no free public tool that reads Google's SynthID text watermark, because verification requires Google's private key. Third-party AI detectors like GPTZero and Originality.ai offer free or low-cost tiers, but they're guessing from writing patterns, not reading an actual watermark.
How long does it take to learn how AI text watermarking works?
A few minutes to grasp the core idea: the model biases word choice, and a key-holder checks for the resulting skew. Understanding what breaks it — paraphrasing, translation, heavy editing — takes about as long to read as this guide.
What is the easiest way to tell if text is AI-generated?
Run it through a detector like GPTZero, Originality.ai, or Turnitin and treat the score as a signal, not a verdict — check for repeated sentence rhythm, generic transitions, and oddly uniform paragraph lengths yourself too, since detectors miss edited AI text often.
Does ChatGPT watermark its text output?
No. OpenAI has researched text watermarking but has not deployed it in ChatGPT. As of May 2026, OpenAI does watermark images from ChatGPT and the API using Google's SynthID alongside C2PA metadata, but that only covers images, not chat text.
Can I remove an AI text watermark?
Rewriting, paraphrasing, or translating the text sharply weakens the statistical signal a watermark relies on, according to Google's own documentation on SynthID. That's a byproduct of normal editing, not a special trick — which is also why watermarking alone isn't a reliable way to catch AI-assisted writing that's been reworked.