Invisible Character Detector & Remover

Paste any text and every character that isn't what it appears to be is marked where it sits, with its Unicode code point and name: zero-width spaces and joiners, stray byte order marks, bidirectional controls, non-breaking and other unusual spaces, soft hyphens, variation selectors, Unicode tag characters, control codes, and letters borrowed from another alphabet. A cleaned copy is ready below, and the Options drawer decides what cleaning removes, what it replaces, and which Unicode normalization it applies.

Hidden messages are decoded. The Unicode tag block (U+E0000–U+E007F) is an invisible copy of ASCII. Text written in it shows nothing on screen, but a language model reading the same string sees every word — the trick behind "ASCII smuggling" prompt injection in documents, emails, and web pages. The detector spells such runs out in plain text. Runs of variation selectors, which can carry arbitrary bytes after an emoji, are decoded the same way.

Trojan Source is called out. Bidirectional overrides and isolates (U+202A–U+202E, U+2066–U+2069) reorder how text is displayed, so a line of code can read one way in a review and run another way. Any of them in your text raises a warning.

Look-alike letters are checked in context. A Cyrillic "а" inside an otherwise Latin word like "pаypal" is flagged, as is a word made only of look-alikes in Latin text, and full-width or mathematical "𝐟𝐚𝐧𝐜𝐲" letters. Genuine Russian, Greek, or Armenian text is left alone. The table is deliberately focused on the pairs used in real spoofing rather than every character Unicode lists as confusable.

Legitimate uses aren't treated as attacks. The zero-width joiners inside 👨‍👩‍👧, the selector that makes ❤️ an emoji, the tags that spell out the Scottish flag 🏴󠁧󠁢󠁳󠁣󠁴󠁿, and the non-joiner inside a Persian word are all reported but shown in grey — and cleaning keeps them unless you switch that off.

Common uses

• Find the zero-width space that makes a password, URL, or spreadsheet lookup fail
• Check a document, email, or web page for instructions hidden from people but read by AI assistants
• Review code or a pull request for Trojan Source bidi characters
• Spot a homoglyph in a link, username, or brand name before you trust it
• Strip non-breaking spaces and soft hyphens from text copied out of Word, PDFs, or web pages

Example

Log in at pаypal.com​ today

Log in at paypal.com today

The “а” is CYRILLIC SMALL LETTER A (U+0430) and an invisible ZERO WIDTH SPACE (U+200B) follows the domain; cleaning swaps the letter for a Latin a and removes the space.

Cleaning and normalization

By default cleaning removes zero-width, byte order mark, bidi, tag, variation selector, soft hyphen, control, and other format characters; turns unusual spaces into ordinary spaces and line separators into line breaks; replaces look-alike letters with the Latin letter they imitate; and applies NFC normalization, which composes an accent typed as a separate combining mark into one character. NFKC goes further and flattens compatibility forms — full-width letters, ligatures like fi, superscripts like ² — into plain characters, which is useful for matching but changes how some text looks.

Limitations

• Look-alike detection covers Cyrillic, Greek, and Armenian letters plus full-width and mathematical styles, not the full Unicode confusables list
• A word in another script that happens to share Latin-looking letters (a Russian "рос" in an English sentence) can be flagged as a look-alike
• Hidden data encoded in ordinary characters — whitespace patterns, punctuation, or zero-width binary codes — is detected as characters but not decoded

How do I find and remove zero-width spaces?

Paste the text into the box. Every zero-width space (U+200B), joiner, word joiner, and byte order mark is shown as a labelled marker exactly where it sits, and the cleaned text below has them removed — copy or download it. Zero-width characters inside emoji are kept unless you turn that off in Options.

Can text contain hidden instructions for ChatGPT or other AI tools?

Yes. Unicode tag characters (U+E0000–U+E007F) mirror ASCII but render as nothing, so a sentence written with them is invisible to a reader while a language model still receives it. This is known as ASCII smuggling and is used for prompt injection. The detector decodes any such run into readable text so you can see exactly what was hidden.

What is the Trojan Source attack?

Trojan Source (CVE-2021-42574) uses Unicode bidirectional overrides and isolates to make source code display in a different order from how the compiler reads it, so a comment can appear to end before code that actually runs inside it. If your text contains any of those control characters, the tool marks each one and shows a warning.

Why does my text have spaces that aren't really spaces?

Word processors, PDFs, and web pages often insert non-breaking spaces (U+00A0), narrow no-break spaces, thin spaces, or em spaces to control line breaks and spacing. They look identical to a normal space but break searches, formulas, and code. The tool names each one, and cleaning replaces them with an ordinary space.

Can it detect homoglyph or look-alike letters in a link?

It flags Cyrillic, Greek, and Armenian letters mixed into Latin words — the usual trick in spoofed domains like paypal.com — along with full-width and mathematical styled letters, and shows which Latin letter each imitates. It is a focused check, not a full implementation of Unicode's confusables list, so treat a clean result as reassurance rather than proof.

Will removing invisible characters break emoji?

Not by default. Family, profession, and skin-tone emoji are joined with zero-width joiners, many emoji need a variation selector, and subdivision flags use tag characters. The detector recognizes those sequences, shows them in grey, and leaves them intact when cleaning unless you switch off “Keep emoji, flags, and joined scripts intact.”

What's the difference between NFC and NFKC normalization?

Both make visually identical text byte-identical. NFC composes characters, so an e followed by a combining accent becomes é. NFKC also replaces compatibility forms with plain ones — full-width ｆｕｌｌ becomes full, the fi ligature becomes fi, and ² becomes 2 — which helps matching but can change meaning in math or typography.

Is the text I paste uploaded anywhere?

No. Detection, decoding, and cleaning all run in your browser, and nothing you paste is sent to a server or saved.