Paste text, a URL, or a filename to find zero-width characters, right-to-left overrides, hidden Unicode tags, and lookalike letters. Each hit comes with a note on how it can be abused.
This tool runs entirely in your browser. What you enter is never sent anywhere.Your input is never sent anywhere.
DetailsPaste the text to scan
Try a sample
Paste some text and the scan results will appear here.
Why Hidden Unicode Characters Are a Security Risk
Unicode contains many characters that draw nothing on screen, or that look just like another character. They exist for good reasons: showing right-to-left languages such as Arabic and Hebrew, joining letters, and choosing how an emoji is drawn.
The same features get abused. Attackers use them to disguise file extensions, build lookalike domain names for phishing, and hide messages inside text that appears normal. Unicode tag characters and variation selectors are used to smuggle hidden instructions into text that an AI chatbot will read, and to attach invisible marks to copied text.
This tool lists every flagged character with its U+ code and explains what that type of character is used for. It goes beyond answering whether the text contains something hidden: it tells you what the character can do, so you can decide whether it matters in your case.
When to Scan Text for Hidden Characters
Checking a suspicious email, link, or attachment
Paste a sender address, URL, or attachment name to see whether a lookalike letter or an RTL override is hiding in it.
Cleaning text copied from a chatbot, PDF, or web page
Copied text can carry zero-width spaces, soft hyphens, and hidden tag characters. Scan it before you paste it into a CMS, a contract, or a prompt.
Debugging two strings that look the same but do not match
If a comparison, a search, or a login fails on values that look identical, an invisible character is a common cause. The preview shows its U+ code and position.
Reviewing user input in a form or API
Run sample input through the checker to see which control, bidi, or zero-width characters your validation needs to handle.
How to Check Text for Zero-Width and Lookalike Characters
- Paste the text, URL, or filename into the box, or click a sample to see how it works.
- Read the risk level at the top: Safe, Caution, or Danger.
- Check the preview, where each flagged character is shown as a highlighted U+ code, and the list of what was found.
- If a hidden message is found, read the decoded text in the purple panel.
- Pick your options in the cleaner and copy the cleaned text.
Note: Your text is processed in your browser. This tool does not send it to a server.
Limits of This Check
- The checker uses a fixed list of known characters and techniques. A clean result does not prove the text is safe.
- Zero-width joiners, variation selectors, and soft hyphens have legitimate uses, so a flag is a prompt to look closer, not proof of an attack.
- Homoglyph detection covers 38 Cyrillic and Greek letters and applies only when the letter shares a word with a Latin letter. Fullwidth letters and other lookalikes are not checked.
- Visible spaces such as the non-breaking space (U+00A0) are not reported.
- For anything that matters, such as an unknown attachment or a possible phishing link, combine this result with your other security checks or ask your IT team.
Character Types This Tool Flags
The six categories the checker reports, with a typical way each one is abused.
| Category | Risk level | Typical abuse |
|---|---|---|
| Bidirectional controls | High | RTLO filename spoofing (an .exe shown as a .pdf) |
| Homoglyphs | High | Lookalike phishing domains and impersonation usernames |
| Unicode tag characters | High | Hidden instructions for AI tools, invisible message embedding |
| Variation selectors | Medium | Data hidden after an emoji or other visible character |
| Zero-width characters | Medium | Invisible fingerprints, broken string matching, filter evasion |
| Other control characters | Medium | Confusing text parsers, evading filters |
Risk levels are this tool's rule of thumb. The real risk depends on how many characters were found, how they are arranged, and where the text is used.
How Unicode Spoofing and Text Smuggling Work
The mechanics behind each technique the checker looks for.
RTLO spoofing: a fake file extension
U+202E (right-to-left override) reverses the display order of the characters after it.
If "invoice_" is followed by U+202E and then "fdp.exe", the real filename ends in .exe, but the screen shows "invoice_exe.pdf".
The reader sees a PDF and opens an executable.
Homoglyph domains: letters that look the same
The Cyrillic "а" (U+0430) and the Latin "a" (U+0061) look almost identical in most fonts.
Replace one letter in a well-known domain and the link looks right in a message or on a page, even though it points somewhere else. This is often called an IDN homograph attack. The same trick works for usernames.
Tag characters: a sentence you cannot see
Unicode tag characters (U+E0000 to U+E007F) include a counterpart for each printable ASCII character. Most fonts draw nothing for them.
Tag characters appended to visible text spell out a hidden message. If that text is pasted into an AI chatbot, the model may read instructions the person never saw. This is often called ASCII smuggling.
Variation selector smuggling: bytes behind an emoji
There are 256 variation selectors (U+FE00 to U+FE0F and U+E0100 to U+E01EF), one for each byte value.
A long run of them after a single emoji can encode a whole text. On screen it still looks like one emoji.
Common Mistakes When Dealing With Hidden Characters
Trusting a filename because it appears to end in .pdf
With an RTL override in the name, an .exe can be displayed as if it ended in .pdf or .txt, and the file gets opened.
💡 See the solution▼
Judging a link by how the address looks
A domain with a Cyrillic or Greek lookalike letter reads as the real site, and people type in their login details.
💡 See the solution▼
Pasting AI or web text into another system without a check
Copied text can carry zero-width characters, or hidden tag characters that act as instructions when another AI tool reads them.
💡 See the solution▼
Treating every zero-width character as an attack
Zero-width joiners appear in emoji sequences and in scripts such as Persian and Hindi, so a flag does not always mean bad intent.
💡 See the solution▼
Hidden Characters and Homoglyphs: FAQ
Q.How do I find hidden characters in text?
A. Paste the text into the box above. The tool checks every character against a built-in list of zero-width characters, bidirectional controls, Unicode tag characters, variation selectors, other control characters, and Cyrillic or Greek letters that imitate Latin ones. Each hit is highlighted in the preview with its U+ code, so you can see exactly where it sits.
Q.What is a zero-width space, and why is it in my text?
A. A zero-width space (U+200B) is a character with no visible width. It often comes along when you copy text from a web page, a chat app, or a document editor, and it can make a string comparison fail even though two values look identical. Run the text through the checker and use the cleaner to remove it.
Q.What is an RTLO attack?
A. RTLO stands for right-to-left override (U+202E). Everything after it is displayed in reverse order. If a filename contains it, a file named "invoice_[RLO]fdp.exe" is shown as "invoice_exe.pdf", so an executable can pass for a PDF. The checker flags U+202E and the other bidirectional controls as high risk.
Q.What is a homoglyph?
A. A homoglyph is a character that looks like another one. The Cyrillic "а" (U+0430) and the Latin "a" (U+0061) are nearly identical in most fonts. Attackers use them to build lookalike domains and usernames. The checker has a list of 38 Cyrillic and Greek letters that resemble Latin letters.
Q.Why was a Cyrillic or Greek letter not flagged as a homoglyph?
A. The checker flags a lookalike letter only when it sits in the same word as at least one Latin letter, such as "аpple". A word written entirely in Cyrillic or Greek, like ordinary Russian or Greek text, is left alone. A domain that uses only lookalike letters and no Latin letter would therefore not be caught.
Q.Can invisible characters hide a message?
A. Yes. Unicode tag characters (U+E0000 to U+E007F) map one-to-one to ASCII characters but display as nothing. Variation selectors (U+FE00 to U+FE0F and U+E0100 to U+E01EF) can represent byte values. Text hidden this way can be placed after visible text or an emoji. When the checker finds either one, it decodes and shows the message.
Q.Does a flagged character mean the text is malicious?
A. No. Zero-width joiners and variation selectors have legitimate uses in emoji and in some scripts, and zero-width spaces often appear in ordinary copy and paste. The tool does not flag a joiner inside an emoji sequence, a lone emoji style selector after an emoji, or the tag characters in the England, Scotland, and Wales flag emoji. Anything else is reported for you to judge, and the risk level reflects the type of character found.
Q.Does it detect non-breaking spaces?
A. No. Non-breaking spaces (U+00A0), en and em spaces, and the ideographic space (U+3000) are visible whitespace variants, not invisible characters, and the checker does not look for them. It also does not check for other lookalike characters such as fullwidth Latin letters.
Q.How do I remove invisible characters from text?
A. Open the cleaner section below the scan results. Choose whether to remove flagged invisible characters and whether to replace homoglyphs with the Latin letters they imitate, then click the copy button. The cleaned text is built only from what the scan flagged, so everything else stays as it was.
Q.Is the text I paste sent to a server?
A. No. The scan, the message decoding, and the cleaning all run in your browser, and the tool does not send your text anywhere. The only time data leaves the page is when you use a copy button, which writes to your own clipboard.
Your feedback
makes this tool better.
Tell us which features you'd like, what should be fixed, or which new tool you'd like to see. An engineer reads every submission and uses it to guide development.