# Invisible Character Checker > Find every zero-width space, bidi override (Trojan Source), Unicode tag character and look-alike letter in text or code, then remove them. Nothing uploaded. - URL: https://bytescope.dev/en/invisible-characters/ - Locale: en · Also: [ja](https://bytescope.dev/ja/invisible-characters.md) · [zh-Hant](https://bytescope.dev/zh-Hant/invisible-characters.md) - Runs: Your files never leave your browser — all processing is local. - Requires: Any modern browser (Chrome, Edge, Firefox, Safari), desktop and mobile. - Updated: 2026-09-08 ## What it does Text can carry characters that take up no space on screen and still change what it means: a zero-width space that breaks a search, a right-to-left override that makes code read differently from how it compiles, a run of Unicode tag characters spelling out an instruction only a language model will read, or a Cyrillic а inside a Latin word so that a link goes somewhere else. Paste text here, or drop a text file of up to 20 MiB — the encoding is detected automatically — and every suspicious character is shown in place as a badge such as `ZWSP`, `RLO` or `TAG a`, with its code point, Unicode name and category. Nothing is uploaded; the analysis runs in this tab. ### What is flagged Bidirectional controls — U+202A to U+202E, U+2066 to U+2069, and the LRM, RLM and ALM marks — the mechanism behind Trojan Source attacks, where source code reviewed on screen is not the code the compiler sees. Zero-width characters: U+200B ZWSP, U+200C ZWNJ, U+200D ZWJ, U+2060 WJ and U+FEFF. Unicode tag characters U+E0000 to U+E007F, decoded back to the ASCII they hide — a known way to smuggle instructions to an LLM in a prompt injection. Unusual spaces: NBSP, thin and narrow spaces, the ideographic space U+3000. Variation selectors, where many in a row may carry hidden data. Other format characters such as the soft hyphen, control characters, and private-use code points. Look-alike letters: Cyrillic or Greek letters mixed into a Latin word — `paypal` spelled with a Cyrillic р and а, for instance — found as mixed-script words using the Unicode UTS #39 confusables data. Three modes, prose, code and URL-or-username, change only the severity shown, not what is detected. ### What is recognised as legitimate Not every zero-width character is an attack. Emoji ZWJ sequences (the family and profession emoji), flag tag sequences, emoji presentation selectors, ZWNJ and ZWJ inside Persian and Indic scripts, the ideographic space in Chinese and Japanese text, and a leading BOM are all shown as information rather than warnings. Clean removes the bidi, tag and zero-width characters by default and leaves those legitimate uses alone; look-alike letters are replaced only in the words you confirm one by one, because a Greek word in a Greek sentence is not a fake. Copy the result or download it as a file. ### Limits Finding these characters does not mean the text was written by AI; finding none does not mean it was not. Many “ChatGPT watermark characters” claims are ordinary typography — a non-breaking space, a narrow space, an em dash — that word processors and web pages have inserted for decades. The look-alike check only sees mixed scripts: a word spelled entirely in Cyrillic is a valid Cyrillic word to it. The legitimate-use judgement can be wrong in either direction. And confusion that happens at the font level, such as a lower-case l and an upper-case I that look identical in some fonts, is not a Unicode matter and is not detected. ## Limits Does not tell whether text was written by AI, does not detect words spelled entirely in another script (only mixed-script words), and does not catch font-level look-alikes such as l and I. ## FAQ ### Can this tell me whether a text was written by ChatGPT or another AI? No. Finding these characters does not mean the text was written by AI; finding none does not mean it was not. Most of what gets passed around as “ChatGPT watermark characters” — non-breaking spaces, narrow spaces, em dashes — is ordinary typography that word processors, web editors and copy-paste from a browser produce on their own. What this page does tell you is exactly which characters are there and where, so you can decide for yourself what to make of them. ### What is a zero-width space, and how did it get into my text? U+200B ZWSP is a character with no width that marks a place where a line may break. It arrives through copy and paste from web pages, chat apps and some editors, and it is invisible until a search fails to match, a username is “taken” by an identical-looking one, or a file name refuses to open. Paste the text here, see each one as a `ZWSP` badge, and remove them with Clean — related characters such as U+200C ZWNJ, U+200D ZWJ, U+2060 WJ and U+FEFF are handled the same way. ### What is Trojan Source, and how do I check code for it? Trojan Source is the use of bidirectional control characters (U+202A to U+202E and U+2066 to U+2069) inside source code so that the order a reviewer sees on screen differs from the order the compiler reads — a comment can visually swallow a statement, or a string can end somewhere other than where it appears to. Paste the code here in code mode: every bidi control is shown as a badge at its position, and Clean removes them. ### What are Unicode tag characters, and why are they used for prompt injection? U+E0000 to U+E007F are a block of characters that mirror ASCII but render as nothing in almost every font. A sentence written in them is invisible to a human reading the page and perfectly readable to a language model that tokenises the raw text, which makes them a known carrier for hidden instructions in web pages, documents and chat messages. This page decodes a run of tag characters back into the ASCII it spells, so you see what the hidden text says, not just that it is there. The flag tag sequences used by some emoji are the one legitimate use and are shown as information. ### How does the look-alike (homoglyph) letter check work? It finds words that mix scripts — a Latin word with a Cyrillic or Greek letter inside it — using the Unicode UTS #39 confusables data to decide which letters are visually interchangeable. `paypal` with a Cyrillic р and а is flagged; a Russian sentence is not, because every letter in each word is Cyrillic. That also means a whole word written in Cyrillic to imitate a Latin one is not caught, and that fonts in which l and I look alike are outside what Unicode can tell you. Replacement happens only for the words you confirm, never automatically. ### Will cleaning break my emoji, Persian text or Hindi text? The default clean removes bidi controls, tag characters and zero-width characters, but the ones that have a recognised purpose are left in place: the ZWJ that holds a family or profession emoji together, the tag sequence of a flag, the presentation selector that makes a symbol render as emoji, and the ZWNJ and ZWJ that shape letters in Persian, Arabic and Indic scripts. Those are shown as information so you can see them, not as findings to remove. The judgement is heuristic and can be wrong either way, so look at the result before you paste it anywhere that matters. ### Is my text uploaded? No. Text and files are analysed in this tab with no request to any server; a 20 MiB file is read with the File API and its encoding detected locally. The cleaned result is copied or downloaded from memory. That is why the page is also fine for the text you would least want to send anywhere — a contract, a password list someone emailed you, a piece of code you suspect. ## Related tools - [Clipboard Inspector](https://bytescope.dev/en/clipboard-inspector.md) — See every format the clipboard holds, including the raw text with control characters shown. - [Hex Viewer / Editor](https://bytescope.dev/en/hex-editor.md) — Look at the exact bytes of a file when a character still looks wrong. - [HAR File Sanitizer](https://bytescope.dev/en/har-sanitizer.md) — Find and redact cookies, tokens and personal data in a HAR file before you share it. - [Office Document Inspector](https://bytescope.dev/en/office-inspector.md) — See the authors, tracked changes and hidden data inside a Word, Excel or PowerPoint file.