Watermarking: What It Protects, and What It Does Not

It survives because it is in the pixels — and that is the whole story

Everything that makes a visible watermark useful and everything that makes it costly come from one fact: it is not attached to the image, it is part of the image. There is no field to clear, no header to strip, no flag to unset. We tested how far that goes. We composited a small mark into the bottom-right corner of a 1600×900 photograph at 60% opacity, then measured the mark box against the untouched original after each transformation. In the watermarked master the region differs from the original by a mean of 17.15 levels. After a JPEG at quality 75, 18.67. After a much harsher quality 40, 20.80. After that same quality-40 file was scaled down to 800×450, 22.39.

The control tells you what those numbers mean. Take the same photograph with no watermark at all, encode it at quality 75, and measure the same rectangle: it differs from the original by 1.98 levels — that is the compression noise floor. The mark sits nine to eleven times above it at every stage, and the number goes up rather than down, because each lossy pass adds its own error on top of a difference that was never going to fade. Compare that to the invisible fields in the same file. The original JPEG carried two metadata markers totalling 1,344 bytes, 0.0239% of the file. We loaded it into a browser canvas and saved it back out — the sort of thing that happens whenever an image passes through a web tool — and both markers were gone, replaced by a generic header and a colour profile. Not stripped on purpose. Just not carried.

The real trade: coverage against intrusiveness

A corner mark is cheap for the viewer and cheap to defeat. Ours occupied a 300×56 box inset 40 pixels from the bottom-right edge. At 60% opacity it changed 4,660 pixels — 0.32% of a 1,440,000-pixel frame — by a mean of 61.84 levels each, and moved the whole-image average by 0.200 levels. Turning the opacity up to 100% only widened it to 4,907 pixels; turning it down to 35% only shrank it to 4,420. Opacity changes how loud the mark is, not how much of the picture it holds.

That is why the corner mark is trivially defeated. Its entire footprint sits in the bottom 96 rows of a 900-row image. Crop those away and you keep 1600×804 — 89.3% of the pixels — with no editing skill involved, no software beyond a phone's photo app, and no trace. Any mark that lives in a margin can be taken out by removing the margin, and most images have margins to spare.

A tiled mark closes that door and opens a worse one. Ours ran diagonally across the whole frame at 18% opacity — deliberately faint — and still touched 169,164 pixels, 11.75% of the image, 36 times as many as the corner mark. There is no crop that removes it, because there is no part of the picture without it. But the cost is now paid by everyone: the whole-image mean deviation went from 0.200 levels to 1.844, and the JPEG grew from 314,890 bytes to 355,169, because the encoder now has to spend bits describing a lattice of text laid over the photograph. Your customers see a photograph with writing on it, which is exactly what you have made.

Removal, honestly

It is worth being accurate here, in both directions. A visible watermark is not unremovable, and pretending otherwise sets people up for a nasty discovery. Content-aware fill and modern inpainting reconstruct small marked regions from their surroundings well enough that a discreet corner logo over a soft background comes out cleanly — and a mark small enough not to bother your viewers is, by construction, small enough to be a good candidate. That is the uncomfortable symmetry of the whole technique: the less it costs you, the less it costs a determined copier.

The other direction matters just as much. Removal takes intent, effort and a tool, and it leaves the copier having deliberately altered your work rather than merely reposting it. That distinction is not nothing. A watermark converts a thoughtless copy into a deliberate act, it keeps your name attached in every casual share, and it makes the lazy path — right-click, save, repost — carry your credit line. Those are real benefits. They are just benefits of friction and attribution, not of security. Design the mark for the person who would have credited you anyway and was never going to look you up, not for the one who has already decided to steal.

Not the same thing: metadata credit fields

EXIF has an Artist and a Copyright tag. IPTC has a fuller set — Creator, Credit Line, Copyright Notice, usage terms — and it is the standard that picture desks and stock libraries actually use. Both are invisible, both are free, both cost nothing in image quality, and both are trivially lost. We measured what that means in practice on a 5.6 MB photograph: its two metadata markers together were 1,344 bytes, 0.0239% of the file, and one pass through a browser canvas removed every one of them without any user action or warning.

So metadata credit is worth filling in, and worth zero as protection. Use it because it costs nothing, because stock and press workflows read it, and because it is the only place to record licence terms in a machine-readable way. Do not use it as evidence that a file is yours, and do not assume a platform preserves it — many strip metadata on upload as a privacy measure, which is the right call for location data and a side effect for your name. Our companion article on EXIF covers what else is in that block and how to inspect it.

Not the same thing either: Content Credentials

C2PA Content Credentials are a genuinely different mechanism, and the only one on this page that makes a verifiable claim. A Content Credential is a cryptographically signed manifest — a record of who produced the asset, with what device or software, and what was done to it since — carried inside the file as a JUMBF box and bound to the pixels by a hash. If a single pixel changes without a new signed entry, validation fails. It is not a mark, it is provenance, and it answers a different question: not "is this mine?" but "what is the recorded history of this file?"

The current version is C2PA Technical Specification 2.4, published in April 2026, following 2.3 in January of the same year; the architecture is also progressing through ISO as ISO/DIS 22144, Authenticity of information — Content Credentials. Adoption is now real rather than theoretical, across camera makers, editing software, generative tools and some newsroom workflows. That matters for the question people always ask next.

The question is: what happens when someone strips it? A manifest is still metadata, so the same browser canvas that erased our EXIF block would erase a Content Credential. The signature cannot be forged, but it can be deleted, and a file with no credential simply says nothing rather than saying something false. That gap is what the specification calls a Durable Content Credential: a credential paired with one or more soft bindings — values computed from the content of the image rather than its raw bytes — so that a stripped file can be matched back to its manifest in a repository. This is where invisible watermarking and Content Credentials meet, and it is why the two are so often confused: one of them is a component of the other.

And not the same thing: invisible watermarking

An invisible or steganographic watermark hides a payload in the pixels below the threshold at which anyone notices — spread across frequency coefficients rather than written into a rectangle. It has the property the visible mark has, in that it is in the image data and survives a re-encode, without the property that ruins the visible mark, in that nobody has to look at it. That is a genuinely attractive combination, and it is why platforms and generative-model vendors use it to label output.

The catch is in the word "survives". An invisible watermark is engineered to tolerate a specific set of transformations — moderate JPEG compression, moderate scaling, a colour tweak — and it degrades against everything else. Hard cropping removes whatever part of the payload lived in the discarded region. Rotation, aggressive re-compression, heavy filtering, and photographing a screen all attack it. And unlike a visible mark, whose failure is obvious to you, an invisible one fails silently: the detector returns nothing, and nothing is indistinguishable from a file that never carried a mark. Treat it as a strong signal when it fires and as no evidence at all when it does not.

So what should you actually do

Decide what you are defending against, because the four mechanisms defend against four different things. If the risk is being uncredited in casual sharing — a portfolio piece, a chart, a product shot that will circulate — a discreet visible mark is exactly right, and 0.32% of the frame is a fair price. If the risk is a client or a marketplace losing track of who made a file, fill in the IPTC fields and accept that they may not survive the trip. If the question is whether an image is what it claims to be, that is Content Credentials, and nothing else on this list answers it. If you need to trace leaks of a file you distributed to named recipients, that is invisible watermarking with a per-recipient payload, and it is a specialist tool.

And if you do place a visible mark, place it deliberately. Keep it off the subject and out of the pure margin — a mark that overlaps the edge of the content is harder to crop away than one floating in empty sky, without covering anything anyone came to see. Keep the opacity low enough that the picture still reads: our corner mark at 35% still altered its pixels by 38 levels on average, which is plainly legible and barely intrusive. Export it onto a copy and keep an unmarked master, because you will need the clean file the first time somebody licenses the image properly.

Frequently asked questions

Does a watermark stop anyone from stealing my image?

No, and no image technique does. What it does is raise the cost of a thoughtless copy and keep your name attached in the many cases where nobody meant any harm. Our corner mark was removable by cropping the bottom 10.7% of the height, which anyone can do on a phone — but the crop is a deliberate act, and so is inpainting the mark away. Watermarking buys friction and attribution. Anything stronger is a licensing and enforcement question, not a pixel question.

Corner mark or tiled mark?

Corner for anything a viewer is meant to enjoy, tiled only for previews you never intended anyone to use as-is. The numbers make the choice for you: the corner mark touched 0.32% of the frame and the tiled mark touched 11.75%, 36 times as many pixels, moving the whole-image mean deviation from 0.200 levels to 1.844 and adding 12.8% to the JPEG. A tiled mark is a proof copy. If you tile a portfolio image, you have published a portfolio of images with writing across them.

Will my watermark survive being uploaded to a social platform?

A visible one will. Platforms re-encode and resize aggressively, and that is precisely what a visible mark tolerates: after a JPEG at quality 40 and a downscale to half size, our mark still measured 22.39 levels above the untouched original, against a compression noise floor of 1.98. Your metadata will not survive that trip — many platforms strip it on upload, largely for privacy reasons — so the caption you thought was carrying your credit is often gone before the first share.

Are Content Credentials a kind of watermark?

No. A Content Credential is a signed provenance manifest carried in the file, bound to the pixels by a hash — it records what the file is and what was done to it, and any undeclared change makes it fail validation. A watermark asserts nothing and verifies nothing; it is a mark. The two do meet in one place: the current specification defines a Durable Content Credential as one paired with soft bindings, and an invisible watermark can serve as one of those, so that a stripped file can be matched back to its manifest. Even then the watermark is the index, not the claim.

Should I watermark at full opacity so it is unmistakable?

Rarely, because opacity buys legibility, not coverage. Between 35% and 100% opacity our corner mark grew from 4,420 to 4,907 affected pixels — about 11% more area — while the mean change per pixel went from 38.03 to 97.91 levels. In other words you get almost three times louder for almost no extra footprint, and a mark that is easy to crop away at 100% is exactly as easy to crop away at 35%. Pick the lowest opacity that still reads at the size the image will be viewed at.