Invisible watermark check
Does this image carry a Stable Diffusion watermark?
Stable Diffusion, SDXL and FLUX quietly stamp a fixed invisible watermark into the pixels of the images they generate, using the open invisible-watermark library. That mark has a public decoder and no secret key, so this tool can read it back in your browser and, if it finds one, name the pipeline that made the image. It is a one-way signal: a hit is a confident yes, a miss is not a no.
Runs entirely in your browser. Your image is never uploaded or stored.
This teaches one basic forensic signal, read in isolation. It is a lead, not a verdict, and can be fooled on its own — real confidence comes from combining several independent signals and understanding the relationship between them.
green = block reads the matched pattern · dark = it doesn't
What this reads, and what it can't
There are two families of invisible AI watermark. The first is open: the invisible-watermark library that Stable Diffusion, SDXL and FLUX use embeds a short, fixed bit-pattern into the image's chroma using a wavelet transform, and both the algorithm and the exact pattern are public. That is what this tool decodes, so a match tells you the image came out of one of those pipelines. The second family is proprietary — SynthID from Google and OpenAI, and the API-only watermarks from Amazon and others. Those have no public decoder, so this tool cannot read them from the pixels. SynthID can still be caught indirectly: a Gemini image usually gives itself away with its visible sparkle (see the visible AI mark finder), and Google and OpenAI attach a C2PA "made with AI" manifest you can read with the metadata viewer.
Why a miss is not a clean bill of health
The open mark is fragile. It lives in the chroma channel, which clamps to 8 bits on bright or flat images, so a valid watermark often fails to decode on exactly those pictures. It also does not survive a JPEG re-save, a resize, a crop or a screenshot. And plenty of AI images carry no open mark at all: re-hosted output, re-encoded exports, and generators like Midjourney embed nothing here. So a miss can mean the image is not from SD/SDXL/FLUX, or that it is but the mark was destroyed. To separate those, the tool runs a carrier check: it embeds a test watermark into your own image and reads it back. If the test survives, this picture could hold the mark, so a real miss is meaningful; if the test does not survive, the picture cannot hold the mark and a miss tells you nothing.
How to read the result
| What you see | What it means |
|---|---|
| Open watermark found (SDXL / FLUX / SD 1.x) | High confidence the image was generated by that pipeline. The pattern matched to within a few bits of an exact, known payload. |
| No watermark, carrier check strong | No open mark, and this image could have held one — so it is likely not pristine SD/SDXL/FLUX output. Still not proof it is real (it could carry SynthID, or be another generator). |
| No watermark, carrier check weak | Inconclusive. This image is too flat, bright or re-compressed to hold the mark, so the absence tells you nothing. |
What fools it
Anything that re-encodes or resamples the pixels: saving as JPEG, resizing, cropping, or screenshotting all wipe the open mark, and the tool will then read a miss. It is also blind by design to SynthID and to any proprietary or API-only watermark. Treat a hit as a strong lead and a miss as unproven, and pair this with the metadata viewer (for C2PA "made with AI" provenance) and the diffusion detector before drawing a conclusion.
Sources
- ShieldMnt / Stability AI, invisible-watermark (open-source library; the
dwtDctDWT-chroma scheme decoded here). The reference decoder this tool ports. - An, R. et al. (2024). WMAdapter: Adding WaterMark Control to Latent Diffusion Models. arXiv:2406.08337. Measures DWT-DCT bit accuracy at ~0.79 on clean images, collapsing under JPEG/crop.
- Saberi, M. et al. (2024). Robustness of AI-Image Detectors (WAVES benchmark). arXiv:2401.08573. Positions DWT-DCT among low-robustness watermark schemes.
Note: the decoder is ported faithfully from the reference library, but validating an exact bit-match against genuine generator output would need a pristine SD/SDXL/FLUX sample; the carrier check confirms the pipeline works on your image. Read a hit as high-confidence, never a miss as proof of a real photo.