Stable Diffusion's invisible watermark: what it is, how to check for it, and when it survives
Stable Diffusion's reference software can write a short, fixed message into the pixels of the images it saves. You cannot see it. Our checker reads it in your browser. In our tests the mark survived a lossless save, but not the usual JPEG save, a resize or a crop, so a missing mark says very little.
What is Stable Diffusion's invisible watermark?
It is a pattern added to the picture data, not a label stored in the file. The reference scripts use an open-source Python package called invisible-watermark. Its default method, "dwtDct", hides each bit of a message in a frequency coefficient of a block of the image. Its README says its methods are robust to noise, colour filters, brightness changes and JPEG compression, but "not robust to resize or aspect ratio changed crop".
The message is the same every time. It is not a record of who ran the software, which computer was used or when. The same pattern is added by anyone running that software, so a match shows the pattern is present and nothing more.
Which versions add it, and what does the message say?
| Software | Message | Length | Where we read it |
|---|---|---|---|
| Stable Diffusion 1.x | The text "StableDiffusionV1" | 136 bits | CompVis txt2img.py |
| Stable Diffusion 2.x | The text "SDV2" | 32 bits | a public mirror of Stability AI's stablediffusion repository |
| Stable Diffusion XL | A fixed 48-bit number that a code comment says was chosen at random | 48 bits | Stability AI's generative-models code and the diffusers watermark module |
We read the 2.x script on a mirror because Stability AI's own repository address returned a not-found error on October 30, 2026. The 1.x and 2.x scripts turn a short piece of text into bits. The XL code uses a fixed number instead. All three apply the "dwtDct" method.
Does every Stable Diffusion image carry it?
No. The mark comes from the software that saves the file, not from the model. Software that does not call the watermark code leaves it out. In the diffusers library, the XL pipeline adds the watermark if the invisible-watermark package is installed, and skips it otherwise, unless the person running it sets the option.
We also hold two files filed on Wikimedia Commons under "Images generated by Stable Diffusion". Our checker found no mark in either. We cannot know how those files were handled before upload, so this shows only what the checker reads in files we hold. It says nothing about the software.
When does the watermark survive?
The README gives a general answer. We tested the specific cases. We made files with the real invisible-watermark package, saved them in different ways, and ran our checker on each.
| What was done to the file | Mark found |
|---|---|
| Saved as PNG | 7 of 7 |
| JPEG, quality 90, no chroma subsampling (4:4:4) | 7 of 7 |
| JPEG, quality 75, no chroma subsampling (4:4:4) | 4 of 7 |
| JPEG, quality 90, usual 4:2:0 subsampling | 0 of 7 |
| JPEG, quality 75, usual 4:2:0 subsampling | 0 of 7 |
| Resized to 90 percent | 0 of 3 |
| Cropped by 17 and 29 pixels | 0 of 3 |
Chroma subsampling is a way JPEG stores colour with less detail. The 4:2:0 setting is the usual one, and it removed the mark at both qualities we tested, 75 and 90. The README's statement about JPEG compression is therefore true only in part for our checker. These are results from one browser and a few files. They are not advice, and a file you hold may behave differently.
The practical point is simple. An image that was shared online may well have been resized, re-saved or both, so "not found" says almost nothing about it. Our accuracy page has the full table and the limits.
Could the checker match by chance?
Every image decodes to some bits, so a checker needs a rule for what counts as a match. We set one threshold per message, above every score we saw on ordinary photographs.
| Message | Best match on any photograph | Threshold to count as found |
|---|---|---|
| XL, 48 bits | 35 of 48 | 45 of 48 |
| 1.x, 136 bits | 85 of 136 | 104 of 136 |
| 2.x, 32 bits | 21 of 32 | 32 of 32 |
None of the 250 photographs reached a threshold. A binomial model, which assumes random bits, puts the chance of a random false match below 1 in a billion per check. The model is a bound and not a measurement, so we also checked 1,440 synthetic graphics and 10,000 stripe images; none reached a threshold either. Five unmarked control images gave no match, and none of the 31 real files we could evaluate matched. One more file was too small to read, because we skip anything under 256 by 256 pixels.
Our browser decode equals the Python package's decode on 50 of 50 files.
Stability AI's own detection script for the XL message labels 36 or more matching bits of 48 as "Very likely watermarked" and 34 or 35 as "Likely watermarked". Our threshold is 45, set so that the chance of a false match stays below 1 in a billion per check.
What this means when you check an image
Open the New Watermark checker, choose the file, and look at the headline.
- "Known watermark pattern matched; source unconfirmed". The detail line reads: "The invisible watermark that Stable Diffusion's reference software adds was found". It then adds: "Anyone running that software adds it; it is not a signed record." This tells you the pattern is present. It does not tell you who ran the software or how the image was used. Any image saved by such software carries the pattern. If a Content Credentials record is also present, that record sets the headline and the watermark appears as a separate finding.
- "No supported provenance signals found". The detail line reads: "This does not mean the image is real or human-made." Our checker found no signed record, no declaring metadata and no matching watermark. Given the table above, a missing watermark says little about an image that has been shared.
Every result also carries the line "These checks cannot determine whether an image is AI-generated." The image stays in your browser while the check runs. The page sends requests only to our own domain (see the privacy page), and our automated tests check that none leave the site. This watermark is the only invisible one we decode. For Google's SynthID, every result links to Google's own detector instead.
Guides on this topic
This guide belongs with How to tell if an image is AI, which sets out every signal and its limits. Related guides:
- Can AI watermarks be removed? covers what survives cropping, screenshots and re-saving, and what the rules say.
- Invisible AI watermarks compared sets this mark beside SynthID, Meta's watermark and Adobe TrustMark.
- Watermark vs metadata vs fingerprint explains what each can prove.
- Stable Diffusion parameters in PNG metadata covers the text some tools write into PNG files.
Frequently asked questions
- Does the watermark show who made an image?
- No. The message is the same fixed value for everyone who runs the software, so it carries no name, date or account. A match shows the pattern is present and no more.
- If the checker finds nothing, is the image not from Stable Diffusion?
- No. Software can leave the mark out, and in our tests the usual JPEG save, a resize and a crop removed it. A missing mark says nothing about how an image was made.
- Does the checker read SynthID or other invisible watermarks?
- No. This is the only invisible watermark it decodes. Every result says that SynthID, Meta's watermark and Adobe TrustMark were not checked, and links to Google's own SynthID Detector.