This invisible character detector scans pasted text for zero-width
characters, bidi formatting overrides, non-standard space characters, and stray control
characters — then offers a cleaned version with them removed or normalized. Runs entirely
in your browser.
How to use it
Paste text and click "Scan". Any suspicious characters found are listed with their Unicode
codepoint, name, and how many times they appear, and a cleaned copy of the text is generated
automatically below.
What gets flagged
Three groups: zero-width/formatting characters like the zero-width space (U+200B) and the
right-to-left override (U+202E), non-standard space characters that look identical to a
normal space but aren't (non-breaking space, ideographic space, and several others), and
non-printable control characters outside the normal tab/newline/carriage-return set.
Why bidi override characters are worth watching for
Inserting U+202E (right-to-left override) partway through a filename makes everything after
it display in reverse order — so a file that's actually an executable can be made to
display with a harmless-looking extension, a real technique used to disguise
malicious file names. Detecting stray bidi-override characters in pasted text or filenames
is a genuine, non-cosmetic security check, not just a formatting curiosity.
Frequently asked questions
Where do invisible characters usually come from?
Copy-pasting from Word, Google Docs, PDFs, or messaging apps is the most common source — smart formatting and autocorrect often leave zero-width spaces, non-breaking spaces, or directional-formatting marks behind. They can also be inserted deliberately, e.g. to defeat exact-match content filters or watermark text invisibly.
Why do these characters cause bugs?
They're invisible in most UIs but still count as real characters to code: they can break exact-string comparisons, make a URL or username silently invalid, inflate character counts, or (for bidi-override characters) even change how surrounding text visually displays.
What does this tool consider "suspicious"?
Zero-width and formatting characters (like ZWSP, ZWJ, and the bidi override/isolate marks), non-standard space characters (like non-breaking space or ideographic space), and non-printable control characters other than tab, newline, and carriage return.
What does "clean" do exactly?
Zero-width and control characters are removed entirely; non-standard space characters (like non-breaking space) are replaced with a normal space so the visible spacing is preserved.
Is my text sent anywhere?
No. Scanning and cleaning both happen entirely in your browser via JavaScript — nothing is transmitted, logged, or stored.