Image watermark remover
Invisible watermarks are signals hidden directly in the pixel data. They survive file format conversion, screenshots and basic editing, and no image editor can see or remove them. On this device it removes the mark Stable Diffusion writes by default, proves it by reading the payload before and after, and strips every trace of metadata. SynthID needs more than filtering can do, so there is a Deep clean option that regenerates the picture instead, and it asks before it sends anything.
The tool
Checking whether this tool is open.
What it does to each scheme
Four different mechanisms get called by one name, and they are not variants of one thing. One of them has a public specification, which means it can be measured. The others do not, which means the work can be described but the outcome cannot be shown. Both are stated.
| Format | Supported | Notes |
|---|---|---|
| Stable Diffusion (DwtDctSvd) | Removed, and measured | The residue that holds each bit is made uniform, so a decoder reads a coin flip. This is the one scheme with a public specification, so the tool reads the payload before and after and shows you both numbers. |
| SynthID | Deep clean only | It is trained specifically to survive noise, blurring, sharpening and compression, so no local filtering reaches it at any strength. The Deep clean option regenerates the picture through a diffusion model, which replaces the fine detail rather than filtering it, and that is the operation published testing finds does remove it. It sends the image to a server, so it asks first. |
| Stable Signature | Deep clean only | Same position as SynthID, and the same answer: regeneration reaches it and filtering does not. |
| Tree-Ring | Deep clean, unmeasured | Its signal is in the structure of the initial latent rather than in the pixels, so it survives pixel-domain edits generally. Regeneration is the only route that touches it, and there is no detector for it anywhere, so nothing here claims a result. |
| Low-bit steganography | Removed | Triangular dither at the final quantisation randomises the low bits everywhere, and a lossy re-encode discards that plane entirely. |
| EXIF, XMP, IPTC, ICC, C2PA | Removed | The output is written fresh and then run through this site’s own byte-level strippers, so nothing from the original container survives and the encoder’s own additions go too. |
How the removal works
The Stable Diffusion mark stores each bit as a remainder: it nudges a value derived from an 8 by 8 patch of the blue-yellow colour channel so that value, divided by 36, leaves a remainder above or below the halfway point. Adding an offset drawn at random from a range exactly one step wide makes that remainder uniform whatever it was, so the decoder is left reading noise. The offset is held constant across each 32 pixel region, which matters: an offset that varied per patch would average back out under any blur, and the watermark would come back.
The stronger settings add two further passes, aimed at older grid-locked schemes rather than at SynthID. A sub-pixel warp leaves nothing aligned to the grid a decoder expects, using a smooth random displacement rather than a rotation, because a rotation can be undone and a random field cannot. Then a small amount of noise is added and taken back out with a shift-invariant wavelet filter. Both cost detail, both are off by default, and the report prints what they cost on your file.
Where this reaches its limit
Everything on this page filters the pixels that are already there. SynthID, Stable Signature and Tree-Ring are all built to survive that: the first two are trained adversarially against noise and blurring and compression, and the third does not live in the pixels at all but in the structure the model started from. Filtering harder does not reach any of them. It only costs you detail, which is why the default setting here now leaves the picture alone and the stronger settings say what they cost.
What does reach them is regeneration: running the picture back through a diffusion model so the fine detail is replaced rather than filtered. That is the whole of the difference, and it follows from where the watermark lives. Anything that keeps the original fine detail keeps the watermark with it. Regeneration is being built and will say clearly, at the moment you use it, where it runs.
The re-encode also destroys any C2PA signature the file carried, permanently and by design. That is usually the point, but it cannot be undone, so it is worth knowing before you start.
Common questions
- What is an invisible watermark, and how is it different from metadata?
- Metadata sits beside the picture in the file, in EXIF or XMP or a signed C2PA manifest, and any stripper can remove it. An invisible watermark is in the pixel values themselves: a pattern of tiny changes spread across the image, too small to see, which a matching detector can still read. That is why it survives being converted, screenshotted, cropped and re-saved, and why no ordinary image editor can find it.
- Does this remove SynthID?
- Not today, and the honest reason is that SynthID is built to defeat exactly what this page does. It is trained against noise, blurring, sharpening and compression, so operations of that kind leave it intact no matter how strong they are; pushing them harder only damages your picture. The one thing published research finds does remove it is regenerating the image through a diffusion model, which replaces the fine detail rather than filtering it. That is being built. Until it ships, this page removes the Stable Diffusion mark, which it can prove, and every trace of metadata, and it does not claim the rest.
- How do you know it worked?
- For one scheme, we can show you. The watermark Stable Diffusion writes by default is open source, so the decoder is implemented here and run twice: once on your file and once on the result. If it read a payload before and now agrees with that payload at the rate a coin would, that is a measurement rather than a claim, and the report prints both numbers. For SynthID, Stable Signature and Tree-Ring there is no public detector at all, so nobody, including us, can measure those either way. The report says which is which.
- Does it damage the picture?
- The default setting, Preserve, leaves luminance bit-identical and changes only the chroma values that carry the mark, so the picture is untouched to the eye and the report says so. The stronger settings do cost detail and the report puts a number on it: Balanced keeps about 84 per cent of the finest detail and Maximum about 65. Those floors are asserted by an automated test at full resolution, which is a change from how this was first built, when the quality metric was measured on a downsampled copy and could not see the damage it was reporting on.
- Are my images uploaded?
- Not unless you pick Deep clean and accept the dialog it puts in front of you. Every other setting runs entirely in your browser, in a worker, and transmits nothing. Deep clean is the exception and it exists because removing a learned watermark needs a diffusion model that will not run on most devices: it sends your image to an endpoint on this same domain, has it regenerated, and sends it back, holding it only for that request and storing nothing. It is off by default and it asks every time, with no memory of the last time you agreed. This page also carries Google advertising, which contacts Google but never touches your file.
- Can I do a whole folder at once?
- Yes, up to thirty images in one go, and you get them back as a single ZIP. A file that fails takes only itself down: each image runs in its own worker, so one damaged file cannot spoil the rest of the batch.