Skip to tool
ecech.
💻 Developer & Code

Invisible Character Detector That Tells You Which Ones Are Dangerous

Finds zero-width spaces, bidi overrides and non-breaking spaces — and says which are harmless formatting and which are used to watermark or disguise text.

Characters

0

Invisible found

0

Security risk

0

Distinct kinds

0

What was found

Made visible

Cleaned

Advertisement

How the calculation works

Two strings that look identical and are not sk_live_4eC39H sk_live_4eC39H Pixel for pixel the same. One of them has a U+200B after the underscore. a === b → false Your API rejects the key. Your logs show the correct key. Nothing looks wrong anywhere. This is also how a document gets watermarked so a leak can be traced to one recipient.

How to Use This Tool

Paste anything you suspect — a key that will not authenticate, a document you received, code that behaves oddly. Every invisible character is listed with its position and what it is for.

Some of these are deliberate

Zero-width characters are not just untidy leftovers. They have uses, and two of them are hostile.

Watermarking. A run of U+200B and U+200C placed between words encodes a binary number — an identifier for whoever received that copy. If the document leaks, pasting it into a checker names the leaker. This is sold as a product, and it is invisible to the person carrying it.

Bidi override attacks. U+202E flips the display order of everything after it. A file called fdp.exe can be shown as exe.pdf. Applied to source code this is CVE-2021-42574, “Trojan Source”: a comment can be made to display as inert text while the compiler reads executable code inside it. Reviewers approve what they see.

Neither leaves a visible trace. That is the entire point of them.

The ordinary damage

Most invisible characters you meet are accidental, arriving from a PDF copy, a word processor or a web page. They still break things, and always in the same confusing way: two strings that look identical do not compare equal.

  • An API key with a zero-width space is rejected, while the logs show the correct key.
  • A password typed correctly fails, because the one on file was pasted with a stray U+200B.
  • A CSV lookup misses rows, because one file has non-breaking spaces where the other has ordinary ones.

None of these produce an error that mentions the real cause, which is why they cost hours.

What U+202E does to a filename stored on disk invoice​[U+202E]fdp.exe shown to the user invoice​exe.pdf One invisible character. The user double-clicks a PDF and runs an executable. The same trick inside source code is CVE-2021-42574.
Nothing in the visible text hints that the order has been reversed.

What counts as dangerous here

The tool splits what it finds into two groups.

Security risk — the bidirectional controls (U+202A to U+202E, U+2066 to U+2069). These change how text is displayed relative to how it is stored, which is the mechanism behind both filename spoofing and Trojan Source. Finding one in text you did not write is worth investigating rather than cleaning away.

Untidy — zero-width spaces and joiners, non-breaking spaces, soft hyphens, the byte order mark. Usually accidental, occasionally a watermark. Safe to strip, and the tool gives you a cleaned copy.

One caveat on stripping: zero-width joiners are load-bearing in emoji. Family and profession emoji are built from several characters joined by U+200D, and removing it splits them into their parts. The cleaner leaves U+200D alone when it sits between emoji.

Advertisement

Frequently Asked Questions

What is U+200B and why is it in my text?
The zero-width space. It usually arrives by accident from a PDF, a word processor or a web page that used it as a line-break hint. It takes no width and shows nothing, but it is a real character, so a string containing one never compares equal to the same string without it.
Can invisible characters be used to track a document?
Yes, and it is a commercial product. A sequence of zero-width characters between words encodes a binary identifier unique to each recipient. If the document leaks, the identifier names who it came from. Nothing about the visible text changes, so the person carrying the watermark cannot see it.
What is a bidi override attack?
U+202E reverses the display order of the text after it, so a file called fdp.exe can be shown as exe.pdf. Applied to source code it is CVE-2021-42574, Trojan Source: a comment can be made to display as harmless prose while the compiler reads executable code inside it, so a reviewer approves something different from what is built.
Is it safe to just strip all of them?
Mostly, with one exception. The zero-width joiner U+200D is load-bearing in emoji — family and profession emoji are sequences joined by it, and removing it splits them into separate people. This tool leaves U+200D alone when it sits between emoji, and strips it otherwise.
Why does my API key fail when it looks correct?
Very often this. A key copied from a web page or a PDF picks up a zero-width space, and the comparison fails while both the input and the log line look identical. Paste the key here — if a character is listed, that is your answer.
Is the text I paste sent anywhere?
No. This runs entirely in your browser, which matters more than usual here because the thing you are most likely to paste is a credential.

Related tools in Developer & Code

Browse all Developer & Code tools
A handwritten note reading ecech.com resting on the keyboard used to build the site.

Made by one person

ecech. is not a content farm. Every tool here is written and checked by hand, one at a time, by someone who wanted the tool to exist and could not find a version that showed its working.

No accounts and no sign-in, and nothing you type reaches a server — every calculation on this page runs inside your browser. The ads are served by Google and do set their own cookies, which is set out in full on the privacy page. More about the site.