Remove watermark from photo: what the box writes over

Short answer: a remover does not write over the watermark — it writes over a box, and the box is always larger than the mark inside it. Measured in Chromium 153 on a 480 × 220 canvas, a 2,745-pixel mark sits inside a 221 × 37 box that covers 8,177 pixels: the box is 2.98× the mark, and 5,432 of the pixels it rewrites were never the mark. Whether that shows depends entirely on the background the extra ring lands on — 0 wrong pixels on a flat fill, 4,960 on noise. Drawing the box one pixel tighter does not help: it samples its replacement from the mark itself and writes 942 clean pixels wrong on a background where a wider box costs nothing.

The mark is small; the box is what gets written

Start with the arithmetic that no tool can avoid. A mark occupies some pixels; a rectangular selection around it occupies more, and the difference is not a rounding error. Measured in Chromium 153 with Sample text at 600 40px Arial on a 480 × 220 canvas, the glyph covers 2,745 pixels, its bounding box measures 221 × 37, and that box holds 8,177 pixels — 2.98 times the mark. Every pixel inside the box is a pixel a rebuild-over-the-box has to write, and 5,432 of them were never the mark.

Those 5,432 pixels are not evenly spread. Measured by distance from the nearest mark pixel, the box is mostly a thin ring: 2,000 of them sit within 1–2 pixels of the mark, 1,721 within 3–5, and 1,505 within 6–10 — but 206 sit further than 11 pixels away, the furthest 19 pixels out. A rectangle drawn around text is filled with whatever the corners enclose, and at the corners it is a long way from any mark pixel. The 1,711 pixels more than five pixels from the mark are pure invention: no mark information reaches them, so whatever a tool puts there it made up.

What the extra ring costs depends on the photo

Now the part that decides whether the result looks clean. Draw the box exactly on the mark and rebuild everything inside it by interpolating between the pixels just outside the left and right edges — the mildest of the ordinary rebuilds. The mark pixels come back close, but the ring around them is rewritten too, and how wrong those rewrites are is a property of the background, not of the tool:

Read the first column against the first row and the whole problem appears. On a flat fill, the pixels on either side of the box are the same value, so a straight line drawn between them reproduces the background exactly and the extra ring costs nothing — the box could be ten times the mark and the result would still be clean. On a gradient the difference is 3,677; on noise it is 4,960. The identically sized box, drawn by the identical tool, is free on one photo and visible on the next, and the only thing that changed is what the photo already had in it.

The wider box in the third column is the same story amplified. Growing the selection by a single pixel adds 392 wrong pixels on the gradient and 516 on the noise, and still nothing on the flat fill. There is no box size that is safe everywhere, because the cost of a given box is set by the picture rather than by the box.

Why a tighter box is worse, not safer

The instinct when the result smears is to draw the box smaller so less gets rewritten. Measured, that makes it worse, and for a reason that is easy to miss: the pixels a rebuild copies from are the ones just outside the box, and if the box is drawn inside the mark, those reference pixels are themselves mark pixels. The reference the tool trusts is dirty.

This is on the flat background, where a box up to any width costs nothing. The moment the box stops enclosing the whole mark, 942 clean pixels come out wrong, and the tighter it gets the worse it is. So the two failure modes sit on either side of the mark: too wide, and the box rewrites background it cannot reconstruct; too tight, and it copies from the mark it was supposed to be replacing. A rectangle is a coarse instrument for a shape that is not one, and both ends of the sizing are the reason.

When the mark is mixed in, the box stops being the limit

Everything above assumes the mark is painted over the photo, opaque, so the background underneath is simply gone. A watermark is usually not that. It is the picture scaled down and mixed with one colour, so every pixel under it still holds a fraction of what was there, and that fraction can be divided back out rather than invented.

AI watermark remover: a mark is mixed into the picture, not painted over it

The word in front of the tool is doing two different jobs, and only one of them needs a model. A watermark is not a patch of different pixels sitting on top of a picture; it is the picture, scaled down and mixed with one colour. Every pixel under it holds (1 − a) of the background plus a of the mark, where a is how strong the mark is at that pixel. At a = 1 the background is gone and the only way forward is to invent pixels. At anything below that the background is still in the file, and getting it back is arithmetic rather than imagination: background = (pixel − a × mark colour) ÷ (1 − a).

Measured in Chromium 153 over the same 228 × 46 box the rest of this page uses, on the flat sample with a background of 240 and a mark colour of 30. Two things in that table are worth stopping on. The first is the row at 0.75: the blend lands on 82.5, an 8-bit pixel has to write 82, and dividing by (1 − a) turns that half-step into a whole 2 — the same rounding at a strength of 0.5 costs nothing, because there the blend lands on a whole number. The second is the last column: being wrong about the strength by one hundredth leaves 1 of 255 at 0.1 and 15 at 0.9, because what the mistake is multiplied by is the gap between the background and the mark colour, divided by how little of the background is left. The arithmetic is exact and unforgiving at the same time.

It is also per pixel, and that is what decides whether it can be used at all. An overlay whose strength runs from 0.2 on one side to 0.8 on the other — which is what the soft edge of a logo is — undone with one number, its own average of 0.5, leaves 126 of 255. Undone with the strength of each column, the same formula leaves 5. What has to be known is not a strength but a shape: where the mark is, and how strong it is at every pixel.

A strength can be read off the picture, though, where the mark covers a patch with texture in it, because blending scales the variation down along with the values: the spread of the pixels under the mark is (1 − a) times the spread of the same patch without it. Measured on the gradient sample that recovers 0.2526 for a true 0.25, 0.496 for 0.5, 0.7379 for 0.75 and 0.8987 for 0.9. Run it end to end — read the strength, then undo the blend with it — and it leaves 1, 3, 12 and 9 on that background, and 2, 3, 19 and 35 on the noisy one.

Set those against the three ways of clearing the same box and the picture changes. On the noisy background, filling the box with one colour sampled from around it leaves 6, and interpolating between its edges leaves 12, whatever the strength of the mark was. So at 0.25 and 0.5 the arithmetic wins comfortably, and at 0.9 — fed the strength it measured for itself — it leaves 35, nearly six times what the crudest guess leaves. Being able to divide the mark back out is worth a lot while the mark is weak, and it is worth nothing once being slightly wrong about it costs more than guessing.

That is the line between the two jobs, and it is also the answer to the two things people say a model is for here. One is that it imagines the picture without the mark in it; the other is that it is a filter being run over an image that has noise in it. Both are right about a different half. Where the mark is translucent and its shape is known, there is nothing to imagine and nothing to filter: the background is in the file and a division takes it back out. Where the mark is opaque, or its shape is not known, (1 − a) is 0 and every pixel in the region has to be invented — which is exactly the case the rest of this page measures, because text sits at a = 1. And whatever invents them is still held to the same threshold as everything else here: what it puts back has to differ from the background by less than the background differs from itself.

One last thing the numbers settle. A faint mark is not a nearly absent mark. At a strength of 0.1 it still moves every pixel under it by 22 of 255, which is nowhere near the floor this page measured for text, and all of it comes back when the blend is undone. What makes a watermark hard to deal with is never that it is faint; it is that its shape is unknown, and that one wrong number about it is multiplied by everything the blend took away.

What this page does not tell you

How any particular service works. Every number here was produced by this browser drawing into a canvas and reading the pixels back, and nothing was uploaded. A tool that rebuilds a region from a learned model is not doing any of the operations above and can beat all of them; what it cannot do is change what counts as clean, because that is set by the photo it was handed and by how large a box it wrote.

The measurements are one string at one size and weight in one font stack, and the 2,745 pixels are a property of that string at that size, not a constant. The noisy background is uniform noise at a known amplitude rather than a photograph, which is structured; structure is what a rebuild can exploit and uniform noise is the case where it has nothing to work with, so a photograph will generally land between the gradient column and the noisy one. This page also does not touch whether a mark is yours to remove; it measures the pixels only.

Measured 2026-10-10 and 2026-10-12 in Chromium 153 via Playwright, canvas 2D, on a 480 × 220 canvas with Sample text at 600 40px Arial and a 221 × 37 box, the same setup the tool above uses on its samples. Related: the number behind whether a patch shows at all, the full list of invisible characters, text that is hidden on a page rather than in a picture, and stripping the invisible characters out of text you can actually see.