What are hidden characters and why do they matter?
Unicode contains hundreds of characters that are invisible or look exactly like others. They have legitimate uses, but they are also used to deceive:
- Zero-width characters (e.g. ZWSP): break a copied password or code so it is rejected for no visible reason, or act as a hidden “fingerprint” to trace who leaked a text.
- Direction controls (e.g. RLO): flip how text is displayed, so
photo_gnp.exeappears to end in.png, or source code looks different from what it really is (the “Trojan Source” attack). - Look-alike letters: the Cyrillic “а” is visually identical to the Latin “a”, so a fake domain can look exactly like a real one.
- Tag characters: a whole invisible text can be hidden inside a message — recently used to smuggle hidden instructions to AI tools.
- Special spaces like the non-breaking space: usually harmless, but they break search, comparisons and spreadsheets.
How to use the tool
- Paste the suspicious text: hidden characters are highlighted in place with their code (e.g. U+200B).
- Check the counters and verdict: orange = usually harmless, red = patterns used for deception.
- Click “Clean text” to remove hidden characters and turn special spaces into normal ones, then copy the result.
What about Arabic text and emoji?
Right-to-left scripts sometimes use RLM or ALM marks to display numbers and brackets correctly, so there is an option to keep them. Composite emoji (like 👨👩👧 and flags) rely on ZWJ and variation selectors; the tool recognises them and leaves them intact.
Practical uses
- Clean text copied from a PDF or Word before pasting it into your website or store.
- Inspect a suspicious message with a link or file name, then analyse the link with the phishing link checker.
- Developers: check code copied from the internet before running it.
Inspection and cleaning happen in your browser; the text is never sent.