Watermarks Remover

guillaumemeyer/watermarks-removerReviewed by Radar

What it does

A Python service plus add-on skills for AI coding assistants (Claude Code, Codex, Cursor) that find and remove AI provenance marks: invisible Unicode characters in text, C2PA and EXIF metadata in images, PDFs and Office files, and, by rewording, statistical text watermarks. It is aimed at technical users. You need Python 3.10+ and a terminal. Text cleaning through the service also needs a rewrite model (local Ollama or an online API). Optional pixel-level image removal downloads about 10 GB of models and works best with an NVIDIA graphics card.

How easy it is to install

C · install 1 or 2 tools · Windows

There is no installer: you install Python 3.10+, run the skill installer script and start the local service from a terminal, and the heavier optional parts need Docker or an NVIDIA graphics card.

Numbers on GitHub

Stars: 25,776on Oct 31, 2026
Downloads: —all releases
Growth: +781stars in 5 days

Stars over time

Facts

Runs on: Windows, macOS, Linux
You need to install: Python
To build from source: Python, Docker, FFmpeg
Disk space: 100 MB–300 MB · estimate
Accounts or keys: Hugging Face (HF_TOKEN, only for optional gated models), OpenAI-compatible model API for text rewriting (WATERMARKS_REWRITE_API_KEY), Password you choose for the local service (WATERMARKS_SERVER_API_KEY)
Cost: Free · If you choose an online rewrite model (the README gives DeepSeek as an example), that provider bills you separately.
License: MIT (Permissive)
Last update: Oct 21, 2026

Risk signals (6)

Attentionremoves ai provenance marks
The main purpose is stripping marks that label content as AI-made (C2PA, SynthID-class watermarks). README 'Ethics and disclaimer': 'For privacy and research on your content — not academic fraud or false “human-written” claims.' The README bibliography cites 'SB 942 / EU AI Act Art. 50' as the AI-labeling context.
AI review
Attentionai detector evasion features
README changelog v0.7.0: 'Pangram bulk API as a human-likeness backend', a 'humanize' tactic that 'names the human-writer rules in the prompt', and a 'New black-box watermark-stealing module and prompt-corpus downloader (#303)' (top-level folder stealer/).
AI review
Inforestricted license optional components
compose.yaml: 'ctrlregen and synthid bake in upstream code that is not publicly redistributable (all-rights-reserved / non-commercial Research License), so they build from source locally and are never pushed to GHCR.'
AI review
Infopinned dependencies with advisories
README: 'Its research-era dependency pins (requirements-ctrlregen.txt — e.g. transformers==4.37.2, diffusers==0.27.2) carry published advisories and are intentionally not current', installed only in a separate venv for the optional CtrlRegen backend.
AI review
Infosetup scripts download third party code
README: setup_synthid.sh, setup_ctrlregen.sh and setup_markllm.sh each 'Clones upstream' repositories, create a venv and install torch and other packages; models download from Hugging Face on first run.
AI review
Infoagent hook edits files
README: the Claude Code plugin 'registers a PostToolUse hook on Write|Edit|MultiEdit|NotebookEdit'; in 'clean' mode it 'Strips the marks in place' in files the agent writes.
AI review

Evidence is shown in its original language.

What Radar could not check

Whether the Windows commands (py install_skill.py, py service/scripts/server.py) work as documented.
How well text watermark removal holds up against real vendor detectors; the README says no tool can certify a detector will fail.
How much the rewording changes the quality and meaning of cleaned text.
Real cost of an online rewrite model, and disk and graphics memory use of the optional ~10 GB pixel-removal models.
What the stealer/ folder and its prompt-corpus downloader send or fetch over the network.