Invisible Character Detector

Find zero-width characters, bidi overrides and lookalike letters in any text.

Processed locally — nothing is uploaded

Text to inspect

About Invisible Character Detector

Every finding names the exact code point, rates how often it appears in attacks, and says when it is legitimate — a joiner inside an emoji is normal, the same joiner inside a username is not. The clean copy strips what cannot be seen and maps imitation letters back to the Latin they mimic, leaving tabs and line breaks alone.

Some text problems are invisible by construction. A zero-width space sits between two letters and occupies no pixels. A right-to-left override makes a filename display in a different order than it is stored, which is how 'gpj.exe' has been dressed up as 'exe.jpg' in real attacks. A Cyrillic а renders identically to a Latin a in most fonts, which is the entire basis of lookalike domains. And a no-break space is indistinguishable from an ordinary one until a search, a comparison or a compiler treats them as different characters — because they are.

This detector walks the text one code point at a time and reports everything the eye cannot vouch for: zero-width and joining characters, every bidirectional control (the set behind the Trojan Source technique, where source code reads one way to a reviewer and compiles another way), deceptive space variants, smart punctuation substituted by word processors, stray control characters, and letters borrowed from other alphabets to impersonate Latin ones. The single strongest signal gets its own warning: a word that draws letters from two different scripts, which is rarely an accident.

The findings are a report, not a verdict, because context decides what a character means. The joiners that build family emoji are the same code points that hide markers inside usernames; the non-breaking space that is correct French typography is the same character that breaks a spreadsheet lookup. Each entry says which situation it is normal in, so you can judge the one in front of you. The clean copy then removes what deserves removing, keeps document structure, and can be re-inspected — the second pass coming back empty is the proof it worked.

Learn how this works

Character Encoding Explained: ASCII, Unicode and UTF-8Why text turns into question marks and mojibake, what Unicode actually is, and how UTF-8 fixed a decades-old mess.5 min read

Frequently asked questions

Why does it flag letters in ordinary Russian or Greek text?

Individual letters in those alphabets legitimately resemble Latin ones, and the per-character findings will say so. The signal that separates real Russian from a spoofed brand name is the mixed-script warning: genuine Cyrillic text is Cyrillic all the way through, while an attack hides one or two borrowed letters inside an otherwise Latin word. Read the word-level warning, not the raw letter count.

Will the clean copy break my emoji?

No. Compound emoji — families, professions, flags — are deliberately built from zero-width joiners, and the cleaner recognises that context and leaves those sequences intact by default. The same character found inside an ordinary word is removed, because there it has no legitimate job.

Where do these characters come from in the first place?

Mostly from copy-paste: word processors substitute smart quotes and typographic dashes, web pages carry non-breaking spaces and soft hyphens, and some sites deliberately embed zero-width characters as invisible fingerprints in copied text. The hostile cases — bidirectional overrides and cross-script lookalikes — arrive in filenames, links, usernames and pasted source code.

Is my text uploaded to be inspected?

No. Everything runs locally in your browser using standard web APIs — your text, files and inputs are never uploaded to a server, so the tool works even offline once the page has loaded.

Pro Tips

→Inspect anything pasted into code, config or a terminal from a document or web page — smart quotes and invisible spaces are the classic cause of a command that fails while looking exactly right.
→Run a suspicious domain or username through before trusting it; a single borrowed letter is enough to register a convincing twin of a familiar name.
→When two strings look identical but a comparison, a dedupe or a spreadsheet lookup insists they differ, this finds the character responsible in seconds.
→Check pull-request diffs containing text you did not type yourself — bidirectional controls in source code are invisible in most editors and reviewable only by detection.
→Clean text before publishing it into a CMS or sending it to a fussy parser, and re-inspect the result rather than assuming; the empty second report is the point.

Common Use Cases

•Developers tracking down why a config value or command pasted from documentation refuses to parse.
•Security-minded readers checking a link or sender domain from a suspicious email before acting on it.
•Moderators and admins vetting usernames that impersonate other accounts through lookalike letters.
•Code reviewers screening contributions for Trojan Source-style bidirectional tricks.
•Data analysts cleaning invisible whitespace out of spreadsheet exports so joins and lookups match again.

How It Compares

Generic Unicode inspectors dump names and code points and leave the judgement to you, which assumes you already know why a word joiner matters. Command-line tools like hexdump show the bytes faithfully and say nothing about meaning. The difference here is the explanation attached to every finding — what the character is, when it is legitimate, and what the clean copy will do about it — plus the mixed-script analysis that catches the spoof even when every individual letter looks defensible.