How to Use This Tool
Paste anything you suspect — a key that will not authenticate, a document you received, code that behaves oddly. Every invisible character is listed with its position and what it is for.
Some of these are deliberate
Zero-width characters are not just untidy leftovers. They have uses, and two of them are hostile.
Watermarking. A run of U+200B and U+200C placed between words encodes a binary number — an identifier for whoever received that copy. If the document leaks, pasting it into a checker names the leaker. This is sold as a product, and it is invisible to the person carrying it.
Bidi override attacks. U+202E flips the display order of everything after it. A file
called fdp.exe can be shown as exe.pdf. Applied to source code this is
CVE-2021-42574, “Trojan Source”: a comment can be made to display as
inert text while the compiler reads executable code inside it. Reviewers approve what they see.
Neither leaves a visible trace. That is the entire point of them.
The ordinary damage
Most invisible characters you meet are accidental, arriving from a PDF copy, a word processor or a web page. They still break things, and always in the same confusing way: two strings that look identical do not compare equal.
- An API key with a zero-width space is rejected, while the logs show the correct key.
- A password typed correctly fails, because the one on file was pasted with a stray U+200B.
- A CSV lookup misses rows, because one file has non-breaking spaces where the other has ordinary ones.
None of these produce an error that mentions the real cause, which is why they cost hours.
What counts as dangerous here
The tool splits what it finds into two groups.
Security risk — the bidirectional controls (U+202A to U+202E, U+2066 to U+2069). These change how text is displayed relative to how it is stored, which is the mechanism behind both filename spoofing and Trojan Source. Finding one in text you did not write is worth investigating rather than cleaning away.
Untidy — zero-width spaces and joiners, non-breaking spaces, soft hyphens, the byte order mark. Usually accidental, occasionally a watermark. Safe to strip, and the tool gives you a cleaned copy.
One caveat on stripping: zero-width joiners are load-bearing in emoji. Family and profession emoji are built from several characters joined by U+200D, and removing it splits them into their parts. The cleaner leaves U+200D alone when it sits between emoji.
