Processed entirely on your device — nothing is uploaded
How to use the invisible character detector
- 1Paste the text you want to check.
- 2Read the revealed markers showing where hidden characters sit.
- 3Check the table for what each one is and why it matters.
- 4Copy the cleaned text.
Where invisible characters come from
Three main sources. Text copied out of PDFs and word processors, which use no-break spaces and soft hyphens for typography. Text pasted from web pages, which frequently carries zero-width spaces used for line-break control. And text produced by language models, several of which emit narrow no-break spaces around punctuation and occasionally zero-width characters mid-word.
None of these are visible in any ordinary editor. The text looks completely normal, which is exactly what makes the resulting bugs so hard to find.
The failures are mundane and maddening. A CSV import puts everything in one column because the delimiter is preceded by a no-break space. A string comparison fails between two values that look identical on screen. `JSON.parse` throws on the first character because of a byte order mark. A code identifier does not resolve because there is a zero-width space inside it. A search finds nothing because the search term and the document use different space characters.
The security angle
Some of these characters do more than break parsing. The bidirectional override characters — U+202E and its relatives — force text to display in a different order from the order it is stored in. That means the code a reviewer reads can differ from the code a compiler executes.
This is the basis of the Trojan Source class of attacks, disclosed in 2021, which affected essentially every major programming language. A comment can be made to render as if it ends where it does not, hiding executable code in plain sight during review. Several source-control platforms now warn about these characters for exactly this reason.
The same characters have long been used to disguise filenames, making an executable appear to end in a harmless extension.
More recently, invisible Unicode tag characters (U+E0000–U+E007F) have been used to conceal instructions inside text intended for a language model — text a human reviewer cannot see at all. This tool flags those as well.
What gets removed, and what is kept
Cleaning is not simply deleting everything invisible, because some of these characters are load-bearing.
Zero-width joiners are the clearest case: emoji sequences depend on them. A family emoji is several separate emoji joined by U+200D, and stripping it turns one glyph into three. That option is on by default for that reason.
No-break spaces are usually better normalised to ordinary spaces than deleted — they were put there to hold a line together, and removing them entirely closes up words. Deleting them is the wrong repair for "10 km" written with a no-break space.
Line and paragraph separators are converted to real newlines rather than removed, since they were intended as breaks and simply use the wrong character.
Smart quote conversion is offered separately and left off by default, because curly quotes are correct typography in prose and only a problem in code, CSV keys and identifiers.
Where to run this by habit
Before importing a CSV that came from a spreadsheet or an export, especially one that has passed through a word processor.
On any text pasted into a configuration file, an environment variable or a JSON document — a byte order mark at the start of a JSON file is a classic and completely opaque parse failure.
On copy taken from a design tool or a PDF before it goes into a codebase, since designers' tools use typographic spaces liberally.
And on text arriving from an untrusted source that will be read by a language model or displayed as code, where the hidden-instruction and display-order attacks apply.
Everything runs in your browser, so pasting a production configuration file or a customer export here does not send it anywhere.
Frequently asked questions
Why does my text look fine but break my code?
It almost certainly contains a zero-width or no-break character. They are invisible in every ordinary editor, which is why the resulting bugs are so hard to find.
What is a byte order mark and why does it break JSON?
U+FEFF, an invisible character some editors write at the start of a file. JSON.parse sees it as an unexpected character before the opening brace and throws.
Should I remove zero-width joiners?
Usually not — emoji sequences depend on them. Stripping U+200D turns a family emoji into three separate ones. The option to keep them is on by default.
What is Trojan Source?
An attack using bidirectional override characters to make displayed code differ from executed code, so a reviewer approves something other than what runs. Disclosed in 2021 and affecting most major languages.
Why convert no-break spaces instead of deleting them?
They were placed to hold a line together. Deleting closes up the words — '10 km' becomes '10km'. Converting to an ordinary space is the correct repair.
Is my text uploaded?
No. Scanning and cleaning both run in the page, so production configuration and customer exports stay local.