Hidden Character Detector
Paste text to see the characters you can't: zero-width spaces, no-break and other special spaces, soft hyphens, bidirectional controls, Unicode tag characters, variation selectors, control characters, and Cyrillic or Greek letters posing as Latin ones. Each one is shown in place with its name and code point, and the cleanup removes the ones you choose. It runs in your browser — nothing is uploaded.
Paste some text above to check it for hidden characters.
How to Use the Hidden Character Detector
- Paste your text. Anything you want to check — text copied from a PDF, a web page, a chat app, an AI assistant or a pull request. Choose Try a sample to see most kinds of hidden character at once.
- Read the counts. The headline number covers characters that need your attention. Characters doing a legitimate job, such as the joiner inside 👩💻, are counted separately.
- Find each one in place. In the marked-up copy of your text every hidden character appears as a labeled marker — ZWSP, NBSP, RLO — and look-alike letters are underlined. Hover over a marker for its Unicode name and code point.
- Clean the text. Tick what to remove or replace, then copy the cleaned text or download it as a .txt file.
What the Detector Looks For
| Type | Characters | Where they usually come from |
|---|---|---|
| Zero-width characters | ZERO WIDTH SPACE (U+200B), ZERO WIDTH NON-JOINER and JOINER (U+200C, U+200D), WORD JOINER (U+2060), the byte-order mark (U+FEFF) and the invisible math operators (U+2061–U+2064) | Web pages, chat apps, word processors, and files saved with a byte-order mark |
| Soft hyphens | SOFT HYPHEN (U+00AD) | PDFs and e-books, where it marks a place a word may be broken |
| Special spaces | NO-BREAK SPACE (U+00A0), EN QUAD to HAIR SPACE (U+2000–U+200A), NARROW NO-BREAK SPACE (U+202F), MEDIUM MATHEMATICAL SPACE (U+205F), IDEOGRAPHIC SPACE (U+3000) and OGHAM SPACE MARK (U+1680) | Word processors, typeset documents, French and East Asian text |
| Bidirectional controls | Embeddings and overrides (U+202A–U+202E), isolates (U+2066–U+2069), and the marks LRM, RLM and ALM | Arabic and Hebrew text — and "Trojan Source" attacks on code |
| Tag characters | U+E0000–U+E007F | Flag emoji such as 🏴 — and text hidden from readers but not from software |
| Variation selectors | VS1–VS256 (U+FE00–U+FE0F, U+E0100–U+E01EF) and the Mongolian selectors | Emoji (❤️ rather than ❤), ideographic variants — and data tucked after ordinary characters |
| Control characters | C0 and C1 controls other than tab and the line breaks, and DELETE (U+007F) | Old file formats, terminal output, broken encodings |
| Blank fillers | HANGUL FILLER (U+3164), BRAILLE PATTERN BLANK (U+2800) and similar characters that draw as empty space | "Invisible" usernames and blank messages |
| Look-alike letters | Cyrillic or Greek letters inside a word written in Latin, or the reverse | Homograph phishing, spoofed names, typosquatted code |
It also reports the line and paragraph separators (U+2028, U+2029 and NEXT LINE, U+0085) that many programs don't treat as line breaks, the replacement character U+FFFD left behind by encoding errors, the object replacement character U+FFFC, private-use characters — usually icon-font glyphs from a PDF — and any other invisible format character. Tabs, ordinary spaces and line breaks are left alone.
Characters That Are Doing a Job
Some invisible characters are essential. A zero-width joiner glues 👩💻 together from a woman and a laptop, VARIATION SELECTOR-16 turns ❤ into the red ❤️, tag characters spell the flags of England, Scotland and Wales, Persian needs the zero-width non-joiner in words like میخواهم ("I want"), and the Indic scripts use both joiners to choose conjunct forms. The detector recognizes these from the characters around them, counts them separately, draws them in gray, and keeps them when it cleans — unless you tick the last cleanup box.
Why Hidden Characters Cause Trouble
- Search and matching fail. A word with a soft hyphen inside doesn't match the same word without one, and a code copied with a zero-width space is rejected.
- Code breaks — or misleads. A no-break space in Python or C source is a syntax error you can't see, and an invisible joiner can make two identical-looking variable names different. In 2021, the Trojan Source research by Nicholas Boucher and Ross Anderson at the University of Cambridge (CVE-2021-42574) showed that bidirectional overrides can make code display differently from the way the compiler reads it, so a reviewer approves something other than what runs.
- Hidden instructions. Tag characters mirror ASCII one for one, so text that looks harmless can carry an invisible message. Security researchers have shown that some AI models read such messages and act on them. The detector decodes any it finds.
- Look-alike names and links. A Cyrillic а looks exactly like a Latin a, the basis of homograph phishing.
- Layout and parsing surprises. No-break spaces stop lines wrapping, and a byte-order mark at the start of a CSV or JSON file can break the first column or the whole parse.
Text From AI Assistants
Text pasted from AI chat tools sometimes contains narrow no-break spaces or other characters people rarely type, and the detector shows them like any others. They are not evidence of where text came from — word processors, typesetting software and several languages produce the same characters — so this tool reports characters and does not detect AI writing.
Frequently Asked Questions
- How do I find hidden characters in text?
- Paste the text into the detector. Every invisible or look-alike character is listed with its name, code point and count, and shown as a labeled marker at the exact place it occurs, so you can see which word or line it is in.
- What is a zero-width space?
- ZERO WIDTH SPACE (U+200B) is a character with no width that marks a place a line may break. Web pages use it inside long URLs and some languages use it between words, but copied into a form, a spreadsheet or code it makes identical-looking text fail to match.
- How do I remove invisible characters from text?
- Tick the kinds you want gone under Clean up and copy the cleaned text. Special spaces are turned into ordinary spaces rather than deleted, so words stay apart, and characters doing a job inside emoji or Persian and Indic words are kept unless you choose otherwise.
- What is the Trojan Source vulnerability?
- A way of hiding malicious logic in source code with bidirectional control characters, published in 2021 as CVE-2021-42574. An override such as RIGHT-TO-LEFT OVERRIDE (U+202E) reorders how a line is displayed without changing how it is compiled. Many code editors and hosting sites now warn about these characters; this detector shows the stored order.
- What are Unicode tag characters?
- Invisible copies of the printable ASCII characters at U+E0020–U+E007E, plus LANGUAGE TAG and CANCEL TAG. Their legitimate modern use is spelling subdivision flags such as 🏴. Anywhere else they can hide a message in plain sight, which is why the detector decodes and shows the hidden text.
- Why does the detector keep some characters?
- Because removing them would damage the text. Emoji such as 👩💻 are built with zero-width joiners, flags with tag characters, and Persian and the Indic scripts depend on the joiners for correct spelling. These are recognized from their neighbors and kept unless you tick the box to remove them too.
- Can this tell whether text was written by AI?
- No, and no character check can. The detector reports which characters a text contains, and the same characters come from word processors, typesetting and ordinary typing in many languages.