Invisible character detector and ASCII smuggling decoder
Paste text to find the characters you cannot see, and to read any text hidden in invisible Unicode tag characters: zero-width spaces, text-direction controls, hidden Unicode tag characters and words that mix Latin letters with look-alike Cyrillic or Greek ones.
Runs in your browser; nothing you type leaves your device
Paste text to check it.
Hidden text decoded from tag characters
These invisible characters spell the readable text below. Treat it as untrusted, especially if the text is going to an AI assistant.
- Zero-width characters
- 0
- Text-direction controls
- 0
- Unicode tag characters
- 0
- Control characters
- 0
- Other invisible characters
- 0
- Unusual spaces
- 0
- Mixed-script words
- 0
Highlighted text
Cleaned text
Findings
| Line:column | Character no. | Code point | What it is | Kind |
|---|
Text up to a few million characters. The check looks at Unicode code points, so it finds hidden characters but cannot tell whether a particular one is harmless in your text. Real emoji sequences, such as flags and family emoji, are not flagged.
How to find invisible characters
- Paste the text you want to check, or choose Load an example to see what the tool finds.
- Read the counts for each kind of character, the highlighted text and the table with the line, column and code point of every hit.
- Choose Copy cleaned text to get the text with the invisible characters removed.
How hidden characters are found
Unicode defines many characters that print nothing: zero-width spaces and joiners, marks that flip the direction of text, soft hyphens, spaces of unusual widths and the tag characters that mirror ASCII. They are useful in the right place and a nuisance or a weapon in the wrong one. This tool reads your text one code point at a time and sorts each hit into a kind, so you can see what is there before you decide what to do about it.
Seven kinds are reported. Zero-width characters include the zero width space, the joiners and the byte order mark. Text-direction controls are the embeddings, overrides, isolates and marks used in Trojan Source attacks on source code. Unicode tag characters are the U+E0000 block, used to smuggle invisible instructions into text for AI assistants; each run is decoded so you can read the ASCII it spells. Control characters are the C0 and C1 codes other than tab and line breaks. Other invisible characters cover the soft hyphen, invisible math operators, fillers and variation selectors, and unusual spaces are the no-break space, the em and en spaces and the ideographic space. Finally, mixed-script words are words that combine Latin letters with Cyrillic, Greek or Armenian ones, the usual way of faking a domain name or a username.
Zero-width spaces turn up in AI-generated text too. Chat assistants and text pipelines sometimes leave zero-width spaces or joiners in their output, and the same characters can be used as an invisible watermark, so a pasted answer may carry more than you can see. Running the text through this check shows exactly what is hidden in it.
Some of these characters belong in real text, so the tool leaves them alone where they do. A complete flag of England, Scotland or Wales (a black flag followed by a few tag letters and a cancel tag), a zero width joiner between two emoji, and an emoji presentation selector after an emoji are all normal. A joiner or non-joiner inside Persian, Hindi or Arabic words is also normal but is reported, because the tool cannot tell the language of your text.
The cleaned copy removes zero-width, direction, tag, control and other invisible characters. It never changes mixed-script words, because replacing a letter would change the text; fix those by hand after checking the highlighted word.
Tips
- Count what is left with the character counter, which counts characters, bytes and lines.
- Compare the original with the cleaned text in Compare text.
- To remove one specific character everywhere, use Find and replace.
Questions
What are zero-width characters?
They are characters that take no space on screen, such as the zero width space (U+200B), the zero width non-joiner (U+200C), the word joiner (U+2060) and the byte order mark (U+FEFF). They sneak into text copied from web pages and chat apps, and they can break searches, passwords, code and file names without any visible sign. The joiner and non-joiner are also used on purpose in some scripts, such as Persian and Hindi, so check before you remove them.
What is a Trojan Source attack?
Unicode has controls that change the direction text is displayed in, such as the right-to-left override (U+202E). In source code they can make a line look different from what a compiler reads, so a harmless-looking comment can hide real code. The tool lists every bidirectional control so you can see them.
What are Unicode tag characters and why do they matter?
The tag characters (U+E0000 to U+E007F) mirror ASCII but display as nothing. Text written with them is invisible to a reader yet can be read by software, including AI assistants, which makes them a way to smuggle hidden instructions into a prompt or a document. The tool decodes each run of tag characters back to the ASCII text it spells and shows it prominently. This is known as ASCII smuggling. A flag of England, Scotland or Wales is made with a few tag characters on purpose, so a complete flag sequence is not flagged.
Why is a word marked as mixed-script?
Cyrillic and Greek have letters that look the same as Latin ones, such as the Cyrillic а and the Latin a. A word that mixes them, like pаypal with a Cyrillic а, can pass for a real name while pointing somewhere else. The tool lists any word that combines Latin letters with Cyrillic, Greek or Armenian ones and shows which letters do not belong.
Does it flag emoji?
No. A zero width joiner between two emoji, as in the family or profession emoji, and the variation selector that follows an emoji are part of how emoji are built, so they are left alone. The same characters in other places, such as between two letters, are reported.
Is my text uploaded?
No. The text is checked in your browser and never leaves your device.