Watermark Remover

What it removes, verifiably

• Invisible and zero-width characters — zero-width space, word joiner, soft hyphen, BOM, Hangul and Khmer fillers, interlinear annotation marks.
• Unicode tag characters (U+E0000–E007F) and variation selectors — two complete invisible alphabets, and the usual way a message is smuggled inside visible text. Anything found is decoded and shown to you.
• Zero-width binary payloads — runs of ZWSP/ZWNJ/ZWJ encoding bits, decoded under the common mappings.
• Bidirectional controls, including the overrides behind the Trojan Source class of attacks.
• Homoglyphs — Cyrillic and Greek letters standing in for Latin ones, folded only inside words that mix scripts, so genuine Russian or Greek text is left alone.
• Exotic spaces normalised to U+0020, with ideographic space left alone in CJK text where it is ordinary punctuation.
• Image metadata — EXIF, XMP, IPTC, PNG text chunks (where Stable Diffusion writes your prompt), GIF comment and application blocks, timestamps, and data appended past the end of the file.
• C2PA content credentials in PNG, JPEG and WebP — the signed manifest recording which tool made the file, when, and from what.
• PDF document properties and XMP packets, blanked in place so the cross-reference table stays valid and the document still opens.
• Office and EPUB properties — author, last-modified-by, revision count, editing time, company, template, custom properties — plus the per-entry ZIP timestamps that survive Word's own "remove personal information".

What it cannot remove

• Pixel-domain watermarks. SynthID and its relatives live in the image content, not the metadata. Stripping EXIF does nothing to them. Re-encoding does not reliably help either — they are built to survive exactly that. If this matters to you, verify with a detector rather than trusting any remover.
• Statistical text watermarks. See the Layer B note on the Text tab: these are a property of word choice across a whole passage, and only rewriting removes them.
• Metadata inside compressed PDF object streams. A byte-level pass cannot read them. The report says so when it detects them, instead of reporting a clean file.
• Encrypted PDFs. Detected and refused rather than corrupted — decrypt first, then run it through.
• TIFF metadata. The format addresses its own image data through the same tables that hold EXIF, so there is no chunk that can be safely dropped.

How findings are classified

Borrowed from the upstream project, because the vocabulary is the useful part:

• confirmed The thing was present and is now gone. Checkable by hand.
• probable Present and removed, but the character or field has legitimate uses too.
• informational Changed, or worth knowing, but not a mark on its own.
• likely false positive Found, understood, deliberately kept — a joiner inside a family emoji, a title inside an EPUB.

Responsible use

This is for content you own or are authorised to process: stripping the GPS coordinates out of a photograph before you post it, taking your name off a document before it circulates, removing an invisible tracking string someone pasted into text they sent you. Passing off machine-written work as your own, defeating attribution you agreed to, or impersonating someone is not what it is for, and removing a marker does not change what the content is.

Verifying the result

Do not take this page's word for it. exiftool -a -G1 file.jpg lists everything left in an image, c2patool file.jpg checks for content credentials, and qpdf --qdf --object-streams=disable makes a PDF's structure readable so you can grep it. If a check disagrees with the report above, the check is right.

Source

The code is four small dependency-free modules — unicode.js, images.js, pdf.js, containers.js — and there is a test page that runs the assertions in your browser. Read it on GitHub.