02.1Invisible characters
Invisible character detector
Paste text or code to find the characters you cannot see: zero-width spaces, no-break spaces, byte order marks, bidi controls, tag characters, and Cyrillic or Greek letters posing as Latin ones. Each comes with its line, column, code point and name.
or drop a file on this box
1!BOMconst greeting = "HelloZWSPworld";
2!if (accessLevel != "userRLO LRI// Check if adminPDI LRI") {
3!Sign in at pаypal.com or support.аррӏе.com to continue.
4Москва and Αθήνα are written in one script each.
5!Price:NBSP100NBSPEUR, softSHYhyphen, family 👨ZWJ👩ZWJ👧 and ❤VS16.
6!Hidden note:TAGTAGTAGTAGTAGTAGTAGTAGTAGTAGTAGTAGTAGTAGTAGTAG
Found
34 found, 31 selected for fixing.
- Bidirectional controls4
- Tag characters16
- Look-alike letters6
- Zero-width & invisible5
- Variation selectors1
- Unusual spaces2
Tag characters spell out hidden text: ignore the rules
| Fix | Line:col | Char | Code point | Name | Fix |
|---|---|---|---|---|---|
| RLO | U+202E | RIGHT-TO-LEFT OVERRIDECan make code display in a different order than it runs (Trojan Source). | remove | ||
| LRI | U+2066 | LEFT-TO-RIGHT ISOLATECan make code display in a different order than it runs (Trojan Source). | remove | ||
| PDI | U+2069 | POP DIRECTIONAL ISOLATECan make code display in a different order than it runs (Trojan Source). | remove | ||
| LRI | U+2066 | LEFT-TO-RIGHT ISOLATECan make code display in a different order than it runs (Trojan Source). | remove | ||
| TAG | U+E0069 | TAG LATIN SMALL LETTER ITag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0067 | TAG LATIN SMALL LETTER GTag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E006E | TAG LATIN SMALL LETTER NTag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E006F | TAG LATIN SMALL LETTER OTag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0072 | TAG LATIN SMALL LETTER RTag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0065 | TAG LATIN SMALL LETTER ETag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0020 | TAG SPACETag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0074 | TAG LATIN SMALL LETTER TTag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0068 | TAG LATIN SMALL LETTER HTag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0065 | TAG LATIN SMALL LETTER ETag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0020 | TAG SPACETag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0072 | TAG LATIN SMALL LETTER RTag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0075 | TAG LATIN SMALL LETTER UTag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E006C | TAG LATIN SMALL LETTER LTag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0065 | TAG LATIN SMALL LETTER ETag characters are invisible and can spell out hidden text. | remove | ||
| TAG | U+E0073 | TAG LATIN SMALL LETTER STag characters are invisible and can spell out hidden text. | remove | ||
| а | U+0430 | CYRILLIC SMALL LETTER ACyrillic letter in a mostly Latin word; looks like “a”. | → a | ||
| а | U+0430 | CYRILLIC SMALL LETTER ACyrillic letter in a mostly Latin domain name; looks like “a”. | → a | ||
| р | U+0440 | CYRILLIC SMALL LETTER ERCyrillic letter in a mostly Latin domain name; looks like “p”. | → p | ||
| р | U+0440 | CYRILLIC SMALL LETTER ERCyrillic letter in a mostly Latin domain name; looks like “p”. | → p | ||
| ӏ | U+04CF | CYRILLIC SMALL LETTER PALOCHKACyrillic letter in a mostly Latin domain name; looks like “l”. | → l | ||
| е | U+0435 | CYRILLIC SMALL LETTER IECyrillic letter in a mostly Latin domain name; looks like “e”. | → e | ||
| BOM | U+FEFF | BYTE ORDER MARKA UTF-8 byte order mark at the start of the file. Some tools (shells, PHP, older parsers) choke on it. | remove | ||
| ZWSP | U+200B | ZERO WIDTH SPACEInvisible; breaks string comparison, search and identifiers. | remove | ||
| SHY | U+00AD | SOFT HYPHENOnly visible where a line breaks; breaks search inside words. | remove | ||
| ZWJ | U+200D | ZERO WIDTH JOINERPart of an emoji sequence (it joins the emoji either side). | remove | ||
| ZWJ | U+200D | ZERO WIDTH JOINERPart of an emoji sequence (it joins the emoji either side). | remove | ||
| VS16 | U+FE0F | VARIATION SELECTOR-16Selects emoji or text style for the character before it; normal. | remove | ||
| NBSP | U+00A0 | NO-BREAK SPACE | → space | ||
| NBSP | U+00A0 | NO-BREAK SPACE | → space | ||
What it looks for
- Zero-width characters (U+200B, U+200C, U+200D, U+2060, U+FEFF) and fillers that render as nothing. They break string comparisons, search and identifiers.
- Unusual spaces: the no-break space and the other Unicode spaces, which look like ordinary spaces but are not matched by many parsers.
- Bidirectional controls. Overrides and isolates can make code display in a different order than the compiler reads it, the “Trojan Source” attack.
- Tag characters and variation selector runs, which can carry hidden text; it is decoded for you.
- Control characters, the byte order mark and soft hyphens.
- Look-alike letters: a Cyrillic or Greek letter inside an otherwise Latin word (or the other way round), and domain names whose labels mix scripts. Words written entirely in Cyrillic or Greek are not flagged.
Suggested fixes are ticked: invisible characters are removed, unusual spaces become ordinary spaces and look-alikes become the Latin letter they imitate. Joiners inside emoji and Persian or Indic words are listed but left alone. Untick anything you want to keep.
Questions
Why does my code fail on a line that looks fine?
A zero-width space or a no-break space copied from a web page or chat is a common cause. To a compiler it is a different character, so an identifier or keyword no longer matches.
Is the byte order mark a problem?
Usually not in editors, but shell scripts, PHP files, CSV importers and some JSON parsers choke on it. The tool lists it as BOM when it is the first character.
Is my text sent anywhere?
No. The scan runs in your browser as you type.