Zero-Width Character Detector

Zero-Width Character Detector

Invisible Unicode characters silently embed themselves in text from copy-paste, AI-generated content, and supply-chain attacks. They don’t render visually but can carry watermarks, manipulate text flow, hide malicious code, or interfere with parsing. This tool detects and removes them.

Paste text and the detector will highlight every invisible character, categorize it, and offer a cleaned version. Use strip mode to remove all categories at once or selectively — zero-width only, Bidi controls only, AI watermarks (tag characters) only, or variation selectors only.

What It Detects

• Zero-width spaces (U+200B) — invisible space for soft-wrapping without line breaks
• Zero-width joiner / non-joiner (U+200D, U+200C) — join or prevent joining of adjacent characters in scripts like Arabic and Devanagari
• Byte-order mark (U+FEFF) — marks file encoding endianness; often corrupts plain-text imports
• Word joiner (U+2060) — prevents line breaks without rendering space
• Bidirectional controls (U+200E-200F, U+202A-202E, U+2066-2069) — override text direction for RTL/LTR display; used in Trojan-Source attacks to hide code
• Soft hyphen (U+00AD) — suggests line-break point when text reflows; can corrupt copy-pasted content
• Variation selectors (U+FE00-FE0F, U+E0100-E01EF) — select glyph variants for emoji and CJK characters; accumulate when exporting from design tools
• Tag characters (U+E0000-E007F) — reserved for invisible metadata; used for AI model watermarks and authentication tokens

How to Use

1. Paste your text into the input field. You can also upload a .txt file.
2. The tool instantly highlights every invisible character in the text, color-coded by category.
3. A summary shows the count and breakdown: how many zero-width, Bidi, tag characters, etc.
4. Choose a strip mode: All (remove everything), Zero-width only, Bidi only, Tag only, or Variation only.
5. Copy the cleaned text or download it as a .txt file.

Common Scenarios

• Auditing AI-generated content — ChatGPT and other models embed invisible tokens for watermarking and authentication. When verifying whether text is machine-generated or reviewing for compliance, strip tag characters to remove the markers.

• Supply-chain code security — Malicious dependencies may hide Trojan-Source payloads using Bidi controls. Code reviewers can paste suspect files here to expose hidden directionality attacks before they reach CI/CD.

• Email and anti-phishing — Phishing emails and trojanized content often use invisible characters to obfuscate URLs or bypass filters. Copy-paste the email body to reveal the true text order and catch social-engineering tricks.

• Cleaning clipboard paste-throughs — When copying from Google Docs, Microsoft Word, or Slack, soft hyphens and Bidi markers tag along. Paste into this tool and strip to get clean plain text for code blocks or databases.

• Incident response and text forensics — When investigating whether leaked or leaked credentials contain exfiltration markers or hidden metadata, this tool reveals exactly what invisible data is embedded.

Why Client-Side Matters

Processing on your device rather than uploading to a server has two key advantages:

Privacy — Your text is sensitive. Credentials, code, leaked data, and confidential documents stay in your browser. No logs, no retention, no analytics on what you paste.

No forensic delay — Trojan-Source samples and potentially malicious content don’t need to be uploaded for analysis. Paste and detect instantly. This is critical when reviewing untrusted code repositories or email attachments in real time.

Related Tools

• Unicode Text Converter — convert text to Unicode code points and back; explore character composition.
• String Escape Utility — encode and decode escaped sequences (C, JavaScript, Python, regex, JSON); complement invisible-character detection with full-text encoding visibility.