Zero-width text encoder & decoder

Hide a message in ordinary text, or inspect text for invisible Unicode characters.

Runs locally in your browser. Nothing is uploaded.

Try an example:
This stays readable and unchanged. The hidden message is woven into it invisibly.
0 chars
Keep it short — longer messages create more zero-width characters, increasing detectability
Advanced options Standard mode
Compatibility
Best for most uses. Produces a shorter, less noticeable payload.
The receiver will need the exact same passphrase. New protected messages are encrypted. Choose a strong, unique passphrase.

Without a passphrase, this only hides the message. Use a strong passphrase to encrypt new messages.

Your encoded text
Encoded message will appear here.

Paste text below, then press Reveal message.
StegZero checks it for hidden messages and invisible characters.

Hidden characters are invisible, so suspicious text may look completely normal.
Unicode inspection options content type, file, advanced checks

Files are inspected only in this browser, are not uploaded, and are not saved in local storage. Maximum 1 MiB and 500,000 Unicode code points.

Current passphrase-protected messages verify the passphrase before showing a result. Older messages may not support verification.
Reveal result
Paste text above to begin.

Need a standalone tool? Open the Invisible Unicode Character Detector.

.txt & .md .html & .xml .csv .json 100% client-side

Drop a text file here or click to browse

.txt · .md · .html · .xml · .csv · .json

This ID will be invisibly embedded throughout the file. Keep it unique per recipient or distribution copy.

Drop the file to inspect or click to browse

.txt · .md · .html · .xml · .csv · .json

How Zero-Width Steganography Works

What is zero-width steganography?

  • A technique for hiding secret messages inside ordinary visible text
  • Uses invisible Unicode characters — zero-width spaces, joiners, and separators
  • Unlike encryption, it hides the existence of a message, not just its contents
  • The cover text looks and reads completely normally to any human reader

Standard vs Compatibility mode

  • Standard (default): uses eight zero-width characters — three bits per symbol for a shorter payload
  • Compatibility: uses only ZWSP (U+200B) and ZWNJ (U+200C) — one bit per symbol
  • Compatibility payloads use about three times as many carrier characters, but the smaller alphabet may be preserved by more platforms
  • The local verification button checks StegZero itself. To test another platform, send the encoded text through it and paste the received result into Reveal.

Platform compatibility

  • Twitter/X and Facebook strip zero-width characters — messages will be lost in both modes
  • WhatsApp may strip some rarer characters — Compatibility mode may work better, but verify it before relying on it
  • Email, Telegram, Discord, and plain text files generally preserve all ZW chars
  • Always copy a test message through the target platform and paste the received text into Reveal before relying on it

Good use cases

  • Hiding watermarks in shared documents to track leaks
  • Easter eggs in web pages, GitHub READMEs, or blog posts
  • Puzzles and alternate reality games (ARGs)
  • Learning about Unicode, text encoding, and digital steganography

Passphrase protection

  • New protected messages derive a key from the passphrase and encrypt the message with AES-256-GCM before hiding it.
  • Older StegZero messages used weak XOR obfuscation. Versions 2 and 3 may expose passphrase bytes; re-encode them and change reused passphrases.
  • Choose a strong, unique passphrase. Weak passphrases can be guessed offline from an encoded message.

Zero-Width Steganography — Frequently Asked Questions

Is zero-width steganography secure?

  • Without a passphrase, anyone with a decoder can reveal the message.
  • New messages created with a strong passphrase are encrypted before hiding. The presence of a hidden frame can still be detected.
  • Older protected messages used weak obfuscation and should be re-encoded.

Which Unicode characters are used?

  • Standard: ZWSP (U+200B), ZWNJ (U+200C), ZWJ (U+200D), Word Joiner (U+2060), Invisible Times (U+2062), Invisible Separator (U+2063), Invisible Plus (U+2064), BOM/ZWNBS (U+FEFF)
  • Compatibility: only ZWSP (U+200B = bit 0) and ZWNJ (U+200C = bit 1) — a smaller, more widely preserved pair

How do I decode a steganography message?

  • Paste the text into the Reveal tab above and press Reveal message. StegZero inspects it and extracts hidden messages in Standard, Compatibility, and legacy formats.

Is my data sent anywhere?

  • No. Everything runs in your browser via JavaScript.
  • No text is ever sent to a server — not even anonymised telemetry.
  • The full source code is open on GitHub for independent verification.

How does file watermarking work?

  • The watermark ID uses a checksummed frame; placement depends on the file format
  • JSON uses trailing spaces and tabs; HTML/XML use comments; CSV embeds inside a field without breaking its quoting. Plain text uses distributed zero-width characters.
  • The original file content is completely unchanged — only invisible characters are added
  • Upload a suspected leaked copy to the Check watermark pane to instantly extract the watermark ID

Can StegZero decode Steghide files?

  • No — Steghide is an image and audio steganography tool that hides data inside JPEG/BMP/WAV files. StegZero handles text steganography using invisible Unicode characters.
  • If you have a Steghide-encoded image, you need the steghide command-line tool or a dedicated image steg decoder — not StegZero.
  • If you have text that looks normal but may contain a hidden message, you're in the right place — paste it into the Reveal tab above.
  • Other tools StegZero doesn't cover: Snow (whitespace steganography), OpenStego, and MP3Stego.

How to decode a hidden text message

  • Step 1: Copy the text you suspect contains a hidden message — it will look completely normal
  • Step 2: Open the Reveal tab above and paste the text into the input field
  • Step 3: Press Reveal message. StegZero inspects the text and reveals Standard, Compatibility, and legacy messages
  • Step 4: If the message was encoded with a passphrase, toggle the passphrase option and enter it before decoding
  • Open Unicode inspection details to see which invisible characters and message format were found

Can zero-width text be used for prompt injection?

  • Invisible prompt injection mostly relies on Unicode Tag characters ("ASCII smuggling"), which some AI models read as ordinary text. StegZero never emits them.
  • StegZero payloads are framed, scrambled binary rather than readable instructions, so they are not designed or effective as hidden prompts for a model.
  • To check a prompt or document before an LLM reads it, use the Unicode inspector. Read more about invisible prompt injection and how to defend against it.