MarkMyAss
Proof, not promises. Free open-source AI watermark, metadata &
provenance cleaner.
Website: https://markmyass.com
· Repository: https://github.com/bens777/MarkMyAss
Inspect → Clean → Verify → Download your cleaned file → Download a
Verification Receipt
Quick start with Docker
Docker → one command → http://127.0.0.1:8765
The easiest way to run MarkMyAss locally -- no Python setup required, and
the independent verifiers (ExifTool and
c2patool) come preinstalled in
the image.
Run MarkMyAss
docker run -d --name markmyass \
-p 127.0.0.1:8765:8765 \
ghcr.io/bens777/markmyass:latest
Then open http://127.0.0.1:8765. The port is bound to 127.0.0.1
only, so the UI is reachable from your own machine, never from your
network -- and nothing is uploaded anywhere.
Stop MarkMyAss
docker stop markmyass
Start it again
docker start markmyass
Remove it
docker rm -f markmyass
Update to the latest version
docker rm -f markmyass
docker pull ghcr.io/bens777/markmyass:latest
docker run -d --name markmyass -p 127.0.0.1:8765:8765 ghcr.io/bens777/markmyass:latest
Build the Docker image from source
Prefer to build the image yourself instead of pulling from GHCR?
git clone https://github.com/bens777/MarkMyAss.git
cd MarkMyAss
docker build -t markmyass:local .
docker run -d --name markmyass -p 127.0.0.1:8765:8765 markmyass:local
(The first build takes a few minutes: c2patool is compiled from source in
a throwaway build stage. See "Docker: building the image yourself" below
for the docker compose variant.)
Don't want Docker? See "Run MarkMyAss locally" below for the from-source
and double-click options, or use the hosted version at
https://markmyass.com with zero installation.
MarkMyAss inspects files and text for hidden Unicode characters, embedded
metadata, and provenance signals, removes the ones it can safely remove,
and then independently re-verifies its own output -- with MarkMyAss's own
native detectors and, where applicable, ExifTool
and c2patool -- so it can tell
you what actually changed, with evidence, not vibes. No fake "100%
undetectable" scores: a signal is only ever reported VERIFIED CLEAN
when an independent tool agrees, and every claim MarkMyAss makes about a
watermark or provenance mechanism is documented, sourced, and dated at
/lab, the AI Watermark Lab.
Naming note: MarkMyAss is powered by the GhostMark engine. The
Python package and CLI command remain ghostmark for compatibility --
so you'll type ghostmark inspect ... and see "GhostMark" in CLI
output, while the product, website and documentation are MarkMyAss.
Use MarkMyAss online
https://markmyass.com
No installation. Free, open source tool by Moseisley.sh.
Files are processed temporarily on the server and deleted automatically
-- see "Privacy" below for exactly what that means.
Run MarkMyAss locally
The Docker quick start above is the recommended local setup. If you'd
rather not use Docker (or want to hack on the code), run from source:
git clone https://github.com/bens777/MarkMyAss.git
cd MarkMyAss
pip install -e .
ghostmark demo # generates synthetic fixtures and proves the pipeline works
ghostmark ui # opens http://127.0.0.1:8765 -- 100% local, nothing uploaded
Or from the CLI directly:
ghostmark inspect document.pdf
ghostmark clean document.pdf
ghostmark verify document.ghostmark.pdf
Both the hosted site and the local tool run the exact same open-source
code. The only difference is where processing happens -- see
PRIVACY.md for the precise distinction.
Not comfortable with a terminal? Double-click, instead of the pip install step above:
- Windows:
START-MARKMYASS.bat (or START-MARKMYASS.ps1)
- Linux / macOS:
start-markmyass.sh
These scripts check for Python, set up a virtual environment, install
MarkMyAss, and open the local web UI for you -- with plain-language
errors if something's missing. (The former START-GHOSTMARK /
start-ghostmark.sh names still work as compatibility wrappers.)
Why MarkMyAss is honest about what "AI watermark" means
"AI watermark" gets used for at least seven different things. MarkMyAss
treats them as genuinely separate mechanisms, because they are:
- Hidden Unicode characters -- zero-width spaces, Unicode "tag"
steganography, bidi control marks, etc.
- Formatting artifacts -- unusual whitespace, odd normalization.
- EXIF / XMP / document metadata -- camera/tool/author info embedded
in images and PDFs.
- C2PA / Content Credentials provenance metadata -- a structured,
embeddable manifest describing content origin.
- Embedded file-level provenance structures -- the JUMBF containers
C2PA (and similar schemes) are packaged in.
- Statistical / model-level text watermarks -- a bias in how an LLM
samples tokens, detectable (in principle) only by the provider with
their private detection key.
- Visible image watermarks -- a logo or text baked into the pixels.
MarkMyAss detects and cleans 1-5 to varying degrees (see the table
below). It does not implement 6 or 7 in this release, and says so
plainly in its own output rather than pretending otherwise. If MarkMyAss
can't verify something, it reports UNKNOWN or UNVERIFIED -- never a
fabricated result.
Learn how to run models locally
Cleaning metadata after the fact is one path; avoiding provider-side
provenance at the source is another. MarkMyAss's web UI includes a
practical developer guide covering hosted-vs-open-weight models, a
hardware/budget decision matrix, current recommended open-weight models
(coding, general reasoning, lightweight), local inference tools (Ollama,
llama.cpp, vLLM, LM Studio), and when renting a GPU beats buying one.
https://markmyass.com/run-ai-locally
Locally, the same page is available at http://127.0.0.1:8765/run-ai-locally
once you've run ghostmark ui. Source: src/ghostmark/web/content/run_local.md.
The AI Watermark Lab and benchmarks
/lab is a public capability matrix -- for every signal MarkMyAss knows
about, whether it can detect it, remove it, and independently verify the
removal, its current status, and when it was last checked. Individual
pages go deeper on specific mechanisms:
/lab/claude-watermark
-- separates file/metadata provenance, hidden Unicode, and statistical
model-level watermarking, three genuinely different things people mean
by "Claude watermark."/lab/c2pa -- what MarkMyAss's
heuristic JUMBF-container scan can and can't tell you, and why that's
not the same as cryptographic C2PA manifest validation./lab/hidden-unicode
and /lab/pdf-metadata.
Every Lab page ends with "Something outdated or inaccurate? Open an issue
or submit a pull request" and a "Last reviewed" date -- see
CONTRIBUTING.md for how to update the underlying
data (src/ghostmark/web/lab_data.py). Machine-readable version:
GET /api/lab/status.
/benchmarks is generated
from a reproducible, synthetic-only test corpus
(src/ghostmark/corpus/) -- not hand-written. It runs MarkMyAss's real
inspect → clean → inspect → independently-verify pipeline against every
fixture and reports the actual pass/fail counts, including any known
failures (nothing is hidden). Machine-readable version:
GET /api/benchmarks.
Task-specific pages
Each of these targets a genuinely distinct question, not the same page
with a keyword swapped in -- see /lab
for the underlying methodology any of them link back to:
Content for these lives under
src/ghostmark/web/content/
as plain Markdown, same pattern as the Lab pages. /robots.txt,
/sitemap.xml and /llms.txt are generated from the same canonical list
of indexable pages the test suite checks against (INDEXABLE_PAGES in
src/ghostmark/web/app.py) -- none of them
ever lists a session/download/API route.
The web UI
MarkMyAss
Free AI Metadata & Provenance Cleaner
[ Paste Text ] [ Upload File ]
---------------------------------
STEP 1 — INSPECTION
Document metadata FOUND
XMP metadata NOT FOUND
EXIF metadata FOUND
Hidden Unicode NOT FOUND
C2PA / provenance NOT FOUND
Statistical watermark UNKNOWN
[ Clean File ]
---------------------------------
STEP 2 — CLEANING
Document metadata REMOVED
EXIF metadata REMOVED
Original file PRESERVED
[ Verify Independently ]
---------------------------------
STEP 3 — INDEPENDENT VERIFICATION
Verified with ExifTool 13.x
✓ No embedded metadata found
GhostMark verification: PASS
ExifTool verification: PASS
c2patool verification: PASS
Overall: VERIFIED CLEAN
Statistical AI watermark: NOT CURRENTLY VERIFIABLE
[ Download Clean File ] [ Download Verification Receipt: JSON / HTML / TXT ]
Locally, the server binds to 127.0.0.1 only -- never reachable from
other devices, nothing uploaded anywhere. The hosted deployment is only
reachable through its reverse proxy (see DEPLOY_MOSEISLEY.md).
Verification always re-runs MarkMyAss's own native detectors on the
cleaned output and, if ExifTool and/or
c2patool are installed,
independently cross-checks it with those separate, widely trusted tools --
so you don't have to take MarkMyAss's own word for it. MarkMyAss can
never award itself VERIFIED CLEAN: that verdict requires at least one
available, applicable external verifier to agree. Disagreement is
reported as PARTIAL; no verifier able to run at all is UNVERIFIED;
nothing to check is NOT APPLICABLE; a failure in MarkMyAss's own
cleaning is FAILED -- never inflated. See
/lab for what "independent
verification" actually means per signal. Downloading the cleaned file
serves it with Content-Disposition: attachment and a name like
document.ghostmark.pdf; you can also download a Verification Receipt
(JSON, HTML, or TXT) for the same session, in either order. On the hosted
deployment, both are cleaned up automatically within 10-15 minutes.
CLI
ghostmark inspect FILE [--json]
ghostmark clean FILE [--output PATH] [--json]
ghostmark reprocess FILE [--profile light|medium|strong] [--format png|jpeg|webp] [--output PATH] [--report] [--json]
ghostmark verify FILE [--original PATH] [--json] [--receipt PATH]
ghostmark inspect-text "TEXT" [--json]
ghostmark clean-text "TEXT" [--json]
ghostmark demo
ghostmark ui [--port 8765] [--no-browser]
ghostmark --version
ghostmark --help
Example:
$ ghostmark inspect example.pdf
GhostMark inspection
File: example.pdf
✓ File readable
⚠ Document metadata: FOUND
⚠ XMP metadata: FOUND
✓ C2PA / provenance: NOT FOUND
Risk / provenance signals found: 2
The original file is never modified. Cleaning always writes a new file:
document.pdf → document.ghostmark.pdf
photo.png → photo.ghostmark.png
--receipt PATH writes a Verification Receipt alongside the verify
result; the format is inferred from the extension (.json, .html, or
.txt).
Exit codes: 0 on success, 1 on a handled error (unsupported file type,
file too large, demo failure), non-zero on usage errors.
Support matrix
| Mechanism | Detect | Clean | Verify |
|---|
| Hidden Unicode (text/.md/.json/.csv) | Yes | Yes | Yes |
| EXIF (JPEG/PNG/WebP) | Yes | Yes | Yes |
| XMP (JPEG/PNG/WebP/PDF) | Yes | Yes | Yes |
| IPTC (JPEG) | Yes | Yes | Yes |
| PNG text chunks | Yes | Yes | Yes |
| PDF DocInfo metadata | Yes | Yes | Yes |
| ICC color profile | Yes (preserved) | N/A (preserved) | Yes |
| C2PA / JUMBF (JPEG, PNG, PDF) | Partial (heuristic byte-marker scan) | Partial | Partial (c2patool checks manifest presence only -- not a cryptographic trust validator) |
| Claude statistical watermark | Unverified | Not implemented | Not applicable |
| Gemini statistical watermark | Unverified | Not implemented | Not applicable |
| GPT statistical watermark | Unverified | Not implemented | Not applicable |
| Visible image watermark | Not implemented | Not implemented | Not applicable |
| DOCX | Not implemented (roadmap) | -- | -- |
| Independent cross-check (ExifTool, images/PDF) | N/A | N/A | Yes, if ExifTool installed -- otherwise reported as unknown, never faked |
|
See /lab for the live, per-signal
version of this table with "last tested" dates.
"Partial" for C2PA means: MarkMyAss scans for the JUMBF container structure
(JPEG APP11 segment, PNG caBX chunk) a C2PA manifest is embedded in, and
can strip that container. It does not parse or cryptographically
validate a C2PA manifest -- absence of the container is a strong signal,
not formal proof, and removal is a structural strip, not an audited
guarantee against every possible embedding technique.
"Unverified" for statistical watermarks means exactly that: no provider has
published a public, independently reproducible detector MarkMyAss could
implement, so MarkMyAss reports UNKNOWN rather than guessing. See
src/ghostmark/detectors/statistical.py
for the interface a future real detector would plug into.
Supported file types
| Category | Formats |
|---|
| Text | .txt, .md, .json, .csv |
| Documents | .pdf |
| Images | .png, .jpg / .jpeg, .webp |
.docx is on the roadmap but not in this release -- rather than delay a
working V0, it was left out.
Three separate verbs: Clean, Reprocess, Verify
MarkMyAss keeps three operations deliberately distinct. They are never
chained into a "transform until a detector goes quiet" loop -- that is an
explicit non-goal (see the note under Reprocess).
Clean — metadata / provenance removal, pixels untouched
Strips EXIF / XMP / IPTC / comment / PNG-text / PDF-DocInfo metadata and
the C2PA JUMBF container at the byte/segment level. Pixel data and ICC
color profiles are never touched, so the visible image is byte-identical.
- Does: remove supported embedded metadata and container structures.
- Does not: re-encode pixels, resize, or alter appearance.
- Cannot guarantee: removal of statistical/model-level watermarks
(they aren't in metadata), or that a format has no other embedding
technique it didn't scan for.
Reprocess — a new pixel representation
ghostmark reprocess decodes the image and re-encodes a new pixel
representation, optionally with a mild down-then-up resample and sRGB
colour-space normalisation. Pure Pillow -- no ML/diffusion. Three profiles:
| Profile | Resample | Colour space | Re-encode quality |
|---|
light | none | source colour space preserved (ICC carried through) | JPEG/WebP q95, PNG lossless |
medium | 0.9×→1× | normalised to sRGB (ICC resolved, then dropped) | JPEG/WebP q90, PNG lossless |
strong | 0.75×→1× | normalised to sRGB (ICC resolved, then dropped) | JPEG/WebP q85, PNG lossless |
normalize_colorspace is a real, tested behaviour: when on, an embedded
ICC profile is resolved with an ICC-aware transform to sRGB and the output
carries no profile; when off, the source ICC profile is preserved so a
colour-managed viewer renders identical colours. Reprocess reports SSIM,
PSNR, pixel-change %, dimensions, format and file size. It applies EXIF
orientation, handles RGB/RGBA/grayscale/palette/CMYK inputs, preserves
alpha, and rejects decompression-bomb-sized images.
- Does: produce a re-encoded image plus honest pixel-difference metrics
and an optional observational before/after provenance comparison
(
--report).
- Does not / cannot guarantee: removal of any statistical or
pixel-embedded watermark (e.g. SynthID). SSIM/PSNR describe pixel
difference, not visual identity.
- Explicit non-goal: MarkMyAss never runs
transform → test detector → transform again to chase "undetectable". The before/after report is an
observation, never an optimisation target.
Verify — independent second opinion
Re-inspects a cleaned file with MarkMyAss's own detectors and, when
installed, cross-checks it with ExifTool and c2patool. Each independent
verifier reports an explicit status that is never collapsed into a false
pass:
detected — the verifier ran and the signal is still present.not_detected — the verifier ran and confirmed the signal is gone.unavailable — the verifier tool isn't installed (never treated as
a clean pass).unsupported — installed, but not applicable to this file type.error — it tried to run but timed out / crashed / returned garbage
(again, never a pass).
VERIFIED CLEAN is only ever awarded when a supported signal was found
before cleaning, MarkMyAss's own re-inspection agrees it's gone, and
every independent verifier that could run agrees. Anything else is
PARTIAL, UNVERIFIED (no verifier available/applicable), NOT APPLICABLE, or FAILED.
How cleaning works (and why it's honest about pixels)
Image and JPEG/PNG/WebP metadata cleaning works at the byte/segment
level, not by decoding and re-encoding the image. EXIF/XMP/IPTC/comment
segments (JPEG), text/tIME/eXIf chunks (PNG), or EXIF/XMP RIFF
chunks (WebP) are deleted directly from the container; pixel data and ICC
color profiles are never touched. That means:
EXIF removed
XMP removed
ICC color profile preserved
Pixel dimensions unchanged
Visual content unchanged (byte-identical pixel data)
PDF cleaning uses pikepdf to edit the
document's object graph directly -- pages, fonts, images, text, and links
are untouched; only the /Info dictionary and /Metadata (XMP) stream are
removed. MarkMyAss reopens the cleaned PDF and confirms it's still
structurally readable before handing it back to you.
Text cleaning classifies every suspicious Unicode character before
touching it:
safe_to_remove -- no legitimate role in ordinary text (zero-width
space, Unicode "tag" steganography characters). Removed automatically.safe_to_normalize -- unusual whitespace collapsed to a normal space.potentially_semantic -- bidi marks, ZWJ/ZWNJ, NBSP. These are
sometimes load-bearing (Arabic/Persian/Hebrew/Indic scripts, emoji
sequences, French typography) and are preserved by default.informational -- e.g. a BOM at the very start of a file (a normal
encoding marker, not a hidden signal).
French, German, emoji, code blocks, and Markdown are covered by the test
suite specifically to make sure cleaning doesn't mangle legitimate content.
Privacy
MarkMyAss has two modes with different privacy guarantees -- see
PRIVACY.md for the full explanation.
Local mode (ghostmark ui on your own computer):
- Local-only. No uploads, no cloud processing, no external API calls.
- No telemetry, analytics, or tracking of any kind.
- No user accounts.
- No CDN JavaScript or remote fonts -- the web UI is self-contained
vanilla HTML/CSS/JS.
- The web server binds to
127.0.0.1 only, never 0.0.0.0 by default.
- Uploaded files live only in a randomized per-session temp directory and
are deleted when the session ends or the process exits.
Hosted mode (https://markmyass.com): files ARE temporarily
uploaded to and processed on the server, then deleted automatically
within 10-15 minutes regardless of whether/when you download them. Never
stored in a database, never included in logs. See PRIVACY.md for the
exact policy.
If a future optional feature ever needs network access it isn't already
documented to use, it will be disabled by default and clearly labeled.
Security
- Filenames are sanitized (path components and unsafe characters stripped)
before ever touching the filesystem -- no path traversal via a crafted
filename.
- File extension is checked against an explicit allow-list, plus a
magic-byte sanity check that content roughly matches the claimed type.
- Temp files use randomized names in a per-session directory, cleaned up on
completion and on process exit.
- Untrusted file content is never executed, and parsing failures return a
clean error instead of a stack trace with local filesystem paths.
- Upload size limit enforced via a bounded/streaming reader (50 MB local
default; 10 MB on the hosted deployment).
- The hosted deployment additionally adds per-IP rate limiting, a
concurrent-job cap with per-job timeouts, security response headers, and
no CORS -- see
SECURITY.md.
See SECURITY.md for the full threat model (local and
hosted) and how to report a vulnerability.
Independent verification (ExifTool + c2patool)
MarkMyAss has its own native inspection and cleaning engine -- pure
Python, tag-level, no external tools required. ExifTool is used as an
independent second opinion for supported metadata verification, never
as the engine itself: if ExifTool is installed
and on PATH, ghostmark verify (CLI and web UI) additionally
cross-checks the cleaned file with it -- every property ExifTool reports
is categorized (embedded metadata vs. structural/filesystem/computed
information) so file size or a preserved ICC profile is never mistaken
for "metadata MarkMyAss failed to remove." See
src/ghostmark/independent_verify.py.
If c2patool (the official C2PA
CLI, Apache-2.0/MIT) is also installed, MarkMyAss runs it read-only
against JPEG/PNG/PDF to check whether a C2PA manifest is present. This is
explicitly not cryptographic trust/signature validation -- c2patool
here only answers "is a manifest present," and a clean c2patool result is
never treated as proof that a statistical text watermark was removed.
Neither tool is a hard requirement -- if either (or both) aren't
installed, MarkMyAss says so honestly, reports the relevant checks as
unverified, and continues to work without them. The production Docker
image installs both automatically (see below).
Docker: building the image yourself
The quick start at the top runs the prebuilt image from GHCR
(ghcr.io/bens777/markmyass:latest, published by GitHub Actions on every
push to main). To build and run it yourself from a checkout instead:
docker compose up
This maps the UI to 127.0.0.1:8765 on your host only (see
docker-compose.yml); it is not exposed to your network. The image
installs ExifTool and c2patool automatically during build (c2patool is
compiled from source in a throwaway build stage, so the first build takes
a few minutes longer than a pure-Python image would).
The production/hosted deployment uses the same prebuilt GHCR image -- see
DEPLOY_MOSEISLEY.md and
docker-compose.prod.yml.
Development
git clone https://github.com/bens777/MarkMyAss.git
cd MarkMyAss
pip install -e ".[dev]" # install with dev extras (pytest, ruff, httpx)
pytest # run the full test suite
ruff check . # lint
ghostmark demo # end-to-end smoke test
ghostmark ui # run locally at http://127.0.0.1:8765
Configuration is entirely environment-driven and every value is optional
for local use -- copy .env.example to .env and adjust
if you want to override defaults. There are no secrets anywhere in this
project.
Builds are reproducible: pyproject.toml uses loose (>=) ranges so the
library stays broadly installable, while constraints.txt
pins the exact production dependency closure the test suite is green
against. The production Docker image installs with
pip install . -c constraints.txt; update constraints.txt deliberately
(procedure documented at the top of the file).
See CONTRIBUTING.md for the project layout and how to
add a new detector or cleaner. See
SEO_LAUNCH_CHECKLIST.md for the (manual,
one-time) Google Search Console setup steps for the hosted deployment.
Roadmap
- DOCX metadata support.
- Full C2PA manifest parsing/validation (not just container detection).
- Real statistical watermark detectors, if/when providers publish
reproducible methodology.
From MarkMyAss to Moseisley
MarkMyAss is a free tool from Moseisley.
If you want more than a cleaner, Moseisley lets you build your own team
of AI agents and assistants.
Build your AI crew →
License
MIT -- see LICENSE. Third-party dependency licenses are listed
in THIRD_PARTY_LICENSES.md.
