Llama watermark cleaner

A fixed set of fourteen Unicode codepoints, matched exactly, in text you paste into the page. The match is on the codepoint itself, not on a heuristic, so the behaviour is deterministic: the same input produces the same output every time, and the count reported after cleaning is the count of characters actually removed.

The number is worth dwelling on because the category inflates it. Competing tools advertise over a hundred types of invisible character without naming one. Fourteen is what this implementation handles, the list is published below, and a character outside it passes through untouched. A stated boundary is more useful than an unstated hundred.

Not every entry is handled the same way, and the difference is structural rather than cosmetic. Eleven codepoints are removed outright because they occupy no visual width and deleting them restores the string to what it looks like. Three are space look-alikes: they do occupy width, so deleting them would join two words into one, and each is replaced with an ordinary space instead.

This is why the character count after cleaning does not drop by the number the badge reports, and why a naive strip-everything implementation corrupts text that this one preserves.

Deleted, zero width

U+200B, U+200C, U+200D, U+2060, U+FEFF and U+00AD. Invisible controls, joiners, a byte-order mark and a soft hyphen.

Deleted, directional

U+202A to U+202E. Two embeddings, a pop and two overrides, which silently reorder mixed-direction text.

Replaced with a space

U+00A0 no-break space, U+202F narrow no-break space and U+200A hair space. Each becomes a normal space.

Not on the list

Anything else, including visible lookalike letters from other alphabets. Left exactly as found.

The entire operation is local. No request is made, so there is no allowance, no identity and no transmitted copy of your text.

Step 1

Paste the text. No character ceiling is imposed, since nothing is being posted to a service.

Step 2

Scan. The report separates hidden character findings from flagged phrase patterns and gives a reason for each.

Step 3

Clean, and read the badge. It states the number of characters removed, or that none were found, which is the only record of what was there.

Two unrelated techniques share the word watermark, and conflating them is the central error in this result set. A character-level mark is a substitution or an insertion in the string: an invisible character where a normal one should be. Removing it is mechanical, and one widely cited discussion of the subject puts it plainly, that you simply replace the substituted characters with their real equivalents.

A distributional mark works on generation instead. Each token is scored against the tokens before it and sampling is nudged toward high-scoring options, so the evidence is a statistical fingerprint spread across the whole document rather than a character anywhere in it. That is why paraphrasing a few sentences is reported as a weak removal method: the surface words change and the distribution largely does not. A tool that alters no words cannot touch a mark of that kind, and this one alters no words.

One exemption is coded. A zero-width joiner is normally removed, but not when it sits between two pictographic characters, because that is how a multi-part emoji is assembled. Skin-tone modifiers and variation selectors before the joiner are stepped over when making that decision, so the sequence is recognised rather than half-matched.

One caveat is documented rather than coded, and it is the honest one. The zero-width non-joiner is a functional character in Persian and in several Indic scripts, where it controls letter joining. The tool removes it like any other entry, so text in those languages should be reviewed before cleaning and not after. That limitation is recorded in the tool's own data alongside the character.

Beyond the fourteen codepoints, cleaning on this route normalises spacing in two specific ways: runs of two or more spaces or tabs collapse to a single space, and trailing whitespace is trimmed from the end of each line. Blank lines between paragraphs are preserved on this surface rather than collapsed.

For prose this is invisible and welcome. For anything where repeated spaces were load-bearing, aligned columns in a code comment, ASCII layout, a fixed-width table pasted as text, it is a real change and the output deserves a look before it goes back into place. Indentation at the start of a line is not affected.

Text only. No image, video or file handling of any kind, which is worth saying because the search term for this route is contaminated by an unrelated image inpainting model with a similar name. One paste at a time, no batch input, no export and no API.

No rewriting, no paraphrasing, no correction. The phrase patterns the scanner flags are advisory and are never edited. No claim is made about any detector's response to cleaned text, and none about what any model does or does not embed in its output, because neither is knowable from here.

Engineers debugging equality failures between strings that render identically. Data teams tracing a parser exception back to a byte-order mark that arrived inside a pasted field. Publishers cleaning copy that has crossed three applications on its way to a CMS and picked up a directional control somewhere in the middle.

In each case the value comes from the determinism rather than the cleverness. A fixed list, an exact match and a reported count give you something you can reason about afterwards, which is more than a tool claiming a hundred unnamed characters can offer.