Invisible character detector
Some invisible characters are harmless formatting. Others are not: bidirectional controls can make a line of source code read one way to a reviewer and compile another, and the Unicode tag block can carry an entire hidden message through text that looks perfectly ordinary. This shows you everything that is there before you decide what to do about it.
also rewrite typography
| code point | name | count | action |
|---|---|---|---|
| U+200B | ZERO WIDTH SPACE | 1 | |
| U+00A0 | NO-BREAK SPACE | 1 | |
| U+00AD | SOFT HYPHEN | 1 |
Technical Guide & Mechanics
Detecting Malicious & Hidden Unicode Anomalies
Hidden Unicode characters can represent more than simple formatting quirks—they are actively leveraged in phishing, supply chain attacks, and code obfuscation. Modern compilers and interpreters generally process Unicode in UTF-8, meaning invisible code points like Bidirectional (BiDi) overrides (U+202E, U+202D) can visually invert how code appears in code review UIs while compiling in a completely different sequence.
Another sophisticated technique involves the Unicode Tag block (U+E0001 to U+E007F). These invisible characters were originally designated for language tagging, but malicious actors can encode entire secondary payloads, hidden URLs, or steganographic instructions within seemingly innocent plain-text strings or AI training prompts.
This diagnostic scanner analyzes text at the byte and code point level, categorizing each anomaly with an empirical risk score (Low, Medium, High). Any embedded tag data is instantly decoded and exposed at the top of the interface, providing full forensic clarity before you commit code or trust external inputs.
how to use it
- 01Paste the text you want to inspect.
- 02Read the table: each row is a code point, how many times it appears, and how risky it is.
- 03Strip what you do not want, or copy the text unchanged now that you know.
questions
- What counts as high risk?
- Bidirectional controls and Unicode tag characters. Both can make text display differently from what it actually contains, which is the basis of the Trojan Source technique.
- It found a hidden message. What now?
- Decoded tag text is shown in full at the top of the page. Treat the source as untrusted: something deliberately embedded text you were not meant to read.
- Why are some characters marked as kept?
- A zero-width joiner inside an emoji or between Arabic letters is doing real work. Those are reported but not removed unless you ask.
- Can invisible characters bypass security filters?
- Yes. Attackers frequently insert zero-width characters inside keyword blocklists (e.g. SQL injection or XSS filters) to evade detection.