Can AI watermarks be removed? What survives cropping, screenshots and re-saving, and what the rules say
Sometimes. The companies that add invisible watermarks say they are built to survive common edits, and they also say heavy cropping or compression can make a watermark undetectable. Records stored in a file, such as Content Credentials, can be lost through everyday actions, the makers say. This page covers what survives and what the rules say, not removal tools.
What do the makers say survives?
These are design goals and cautions from the companies, not test results we can check.
| Signal | What the maker says |
|---|---|
| SynthID (Google) | Google DeepMind says it is designed to stand up to cropping, filters and lossy compression. The SynthID Detector page says it designed the mark to remain detectable after filters, colour changes and lossy saves, but that the watermark is "not infallible" and that trying many transformations may find one that goes undetected. |
| SynthID in OpenAI images | OpenAI's help article says SynthID is designed to withstand light edits, copying and pasting, cropping and screenshots. It adds that heavy cropping or file compression can make a watermark undetectable. |
| Content Credentials | The same OpenAI article says they can be lost through everyday actions such as taking a screenshot or converting a file. The Content Authenticity Initiative says metadata of any kind can be removed, deliberately or accidentally. |
| TikTok and Meta marks | In November 2025 TikTok said it was testing an invisible watermark that only TikTok can read, which makes removal harder for others, and that labels can be lost when content is re-uploaded or edited elsewhere. Meta's February 2024 post says people can strip out invisible markers and that Meta is looking for ways to make that harder. |
Does a screenshot or a re-save remove a watermark?
It depends on the signal. A screenshot makes a new image file from what is on the screen. Anything stored beside the pixels, such as a signed record or metadata, usually does not come along. OpenAI lists screenshots among the actions that can cost a file its Content Credentials.
An invisible watermark lives in the pixels, so it can come through. OpenAI states both sides. Its help article says SynthID is designed to withstand screenshots, and also that compression, cropping, noise, edits, format conversion or other transformations can make the watermark harder to detect. Its developer guide says compression, cropping, screenshots, metadata removal and format conversions can erase or weaken a signal. Read a screenshot as "may survive, may not".
The same article lists several reasons a check can find nothing, among them stripped metadata and a degraded watermark.
What did our own tests show?
We can only speak for the one invisible watermark our checker reads: the pattern that Stable Diffusion's reference software adds. On October 27, 2026 we marked test photographs with the real software package, saved them in different ways, and counted what our checker found. The resize and crop tests used one photograph, marked three ways. Five unmarked control images produced no match. The full method is on the accuracy page.
| What was done to the file | Found |
|---|---|
| Saved as PNG | 7 of 7 |
| JPEG, quality 90, without chroma subsampling | 7 of 7 |
| JPEG, quality 75, without chroma subsampling | 4 of 7 |
| JPEG, quality 90, usual 4:2:0 subsampling | 0 of 7 |
| JPEG, quality 75, usual 4:2:0 subsampling | 0 of 7 |
| Resized to 90% | 0 of 3 |
| Cropped by 17 pixels from the top and 29 from the left | 0 of 3 |
The pattern survived lossless saving and one kind of JPEG, and it was not found in any of the 14 files saved with the usual 4:2:0 subsampling, or in any resized or cropped file. These are test results about one open mark, on a small set of files. They say nothing about SynthID or any other mark, because our checker does not read those.
What do the rules say about removal?
There are two kinds of rule: the terms of a service, and the law.
Service terms
Google's terms for the SynthID Detector bar using the service, its outputs or its feedback to run black-box adversarial attacks or to optimize transformations designed to break, bypass or degrade the SynthID detection logic. OpenAI's API guide says: "Don't use repeated queries to reverse-engineer, remove, or evade a watermark."
The EU AI Act
In Article 50 of Regulation (EU) 2024/1689, the duty to mark falls on providers of AI systems. Paragraph 2 says outputs must be marked in a machine-readable format and detectable as artificially generated or manipulated. It says the technical solutions must be effective, interoperable, robust and reliable as far as this is technically feasible. Paragraph 4 requires deployers of a system that produces a deep fake to disclose that it was generated or manipulated. The European Commission's guidelines page says these transparency obligations apply from August 2, 2026.
California
The California AI Transparency Act began as SB 942 in 2024, and AB 853 moved its start to August 2, 2026. As amended by SB 1000, approved on September 30, 2026, it requires a covered provider to include a latent disclosure, to the extent technically feasible, in image, video and audio content its system creates or alters. The disclosure must be "permanent or extraordinarily difficult to remove or tamper with". SB 1000 also deleted the earlier threshold of over 1,000,000 monthly visitors or users. We read the chaptered bill texts, not the current code. Our guide to the California AI Transparency Act has the dates.
In the passages we read, these duties fall on the companies that build and run AI systems and platforms. We did not find a passage that addresses a private person who edits a file. Laws change, and other rules may apply to you. For advice about your own case, ask a lawyer.
What this means when you check an image
Open the New Watermark checker and choose the file. If it finds nothing, the headline reads "No supported provenance signals found". The sentence under it says this does not mean the image is real or human-made, and that most images lose these signals when they are shared, screenshotted or re-saved.
If the file carries the Stable Diffusion pattern, the headline reads "Known watermark pattern matched; source unconfirmed". It means the pattern that Stable Diffusion's reference software adds was found. Anyone running that software adds it, and it is not a signed record.
Every result also says that Google's SynthID watermark was not checked here. For that, use Google's SynthID Detector. It is another company's site, you may need to sign in, and your image is uploaded to them, not to us. What is SynthID? explains what its result means.
Guides on this topic
- What is SynthID?, the page this guide belongs to.
- Invisible AI watermarks compared
- Watermark, metadata and fingerprint: what is the difference?
- Why Content Credentials disappear
- EU AI Act Article 50 and marking AI images
Frequently asked questions
- Can SynthID be removed?
- Google says SynthID is built to survive common edits, and also says it is not infallible. We do not read SynthID, so we have no test result for it, and we do not describe ways to defeat it.
- Does a screenshot remove Content Credentials?
- OpenAI says Content Credentials can be lost through everyday actions such as taking a screenshot or converting a file. A screenshot is a new file, and the signed record is not part of the picture.
- If a check finds no watermark, was the image made by a person?
- Not necessarily. OpenAI's API guide calls a not-detected result an absence of detected evidence, and not proof that the content is human-created. Signals can be missing for many reasons.
- Is removing a watermark against the law?
- We cannot say, and this is not legal advice. In the passages we read, the EU and California duties fall on providers and platforms, and some service terms bar certain uses. Ask a lawyer about your own case.