Perplexity watermark detector

The Perplexity watermark detector performs one measurement and reports it precisely: which of fourteen invisible Unicode codepoints occur in the text you paste, and where. Alongside that it marks the phrase patterns associated with machine-written prose, each with the reason it was flagged. Both passes are computed in the browser, so the measurement leaves no trace and carries no run allowance.

Naming the measurement narrowly is the point. Most pages competing for this term describe a detector as something that weighs style variance, sentence repetition and statistical predictability and returns a confidence figure. This one does none of that, and the value of saying so is that you can read a result here and know exactly what evidence produced it.

Perplexity is a product: an answer engine that retrieves web pages and composes replies from them. Perplexity is also a quantity in information theory, the exponentiated cross-entropy of a model on a passage, used as a proxy for how predictable that passage is. AI detection literature uses the second. Search results for the term mix the two indiscriminately, which is why a query for this phrase returns both tool pages and arXiv papers on watermarking schemes.

This tool addresses the product. It reads text copied out of the Perplexity answer engine. It computes no cross-entropy, returns no perplexity value, and issues no probability that a passage is machine-written. A page that offered both would be describing two different engines under one name.

The scan set is fixed and enumerable, so it can be published in full rather than summarised.

U+200B, U+200C, U+200D, U+2060

Zero-width space, non-joiner, joiner, word joiner. Zero advance width, non-zero effect on any tool that reads the string. Joiners inside emoji sequences are recognised and preserved.

U+FEFF

Byte-order mark. Legitimate as the first unit of a file, a defect anywhere after it.

U+00AD

Soft hyphen. A conditional line-break opportunity that renders as a hyphen only when the break is taken.

U+00A0, U+202F, U+200A

No-break, narrow no-break and hair space. Visually equivalent to U+0020 at most sizes and distinct in every byte comparison. Normalised to U+0020 rather than deleted.

U+202A, U+202B, U+202C, U+202D, U+202E

Directional embeddings, the pop, and the two overrides. An unmatched member of this set changes display order without changing content.

The procedure is short because the computation is cheap. Nothing is queued, transmitted or retained.

1. Capture

Copy the answer with its citation markers intact. Stripping them first discards the region where findings cluster.

2. Scan

Each occurrence is rendered as an inline chip carrying the codepoint. Position matters as much as presence: one mark at a paste boundary reads differently from marks distributed through the body.

3. Normalise

Removal strips the zero-width and directional set and maps the space look-alikes onto U+0020. Visible content is unchanged by construction.

Perplexity composes answers from fetched documents. Those documents were typeset by publishing systems that insert invisible characters deliberately: narrow no-break spaces before units, soft hyphens at wrap candidates, byte-order marks written by exporters. The characters are correct in their original context and become noise once the surrounding material is quoted into something else.

A model answering without retrieval has one route for residue, the rendering of its own reply. A retrieval engine has two, and the second is not under its control. That asymmetry is the clearest reason to scan Perplexity output specifically rather than treating all AI text as one category.

A third variable is the model selector. Perplexity routes answers to a model the user chooses, so scan results across two sessions describe two different generation paths. Inconsistent findings are expected and are not evidence that the scan is unreliable.

Four exclusions, listed because omitting them would make the scan sound broader than it is. It does not identify which model produced a passage. It does not score how machine-like the writing is. It does not detect statistical watermarking schemes of the kind described in the academic literature, which are embedded in token selection and leave no character-level trace. And it does not examine any codepoint outside the fourteen above, including variation selectors, invisible math operators and bidirectional isolates.

Each of those appears on at least one competing page as a capability. Treat a page that claims all of them at once with the scepticism you would apply to any instrument with no stated error bars.

No, in both directions, and the second direction is the one that misleads people. A positive finding establishes that the string contains a given codepoint. Any rich-text surface can put it there: a content management system, a PDF export, a word processor, a chat client, a hand copy from a web page. Authorship is not recoverable from a character inventory.

A negative finding is weaker still. Clean text is the normal state of anything retyped, pasted through a plain-text buffer, or generated by a path that leaves no residue. Reporting a clean scan as evidence of human authorship inverts the logic entirely. The honest reading of any result is: this string contains these characters, as of this copy.

Analysts moving research from Perplexity into reports and decks, where a byte-order mark in a quoted figure breaks an export hours later. Technical writers checking documentation before it enters a repository, where invisible characters survive review and surface as a failing build. Engineers who pasted a configuration snippet out of an answer and are looking for the reason it will not parse.

Editors use it too, on submitted work, and the useful framing there is diagnostic rather than accusatory. The scan tells you what a document carries. What that means about how the document was written is a separate question the scan cannot answer.