What the detector finds
The inspector reports bidirectional controls, Unicode Tags, variation selectors, join controls, zero-width and line-breaking formats, invisible mathematical operators, control codes, unusual spaces, blank fillers, and other default-ignorable characters. Optional advanced checks cover private-use, noncharacter, unassigned, and orphan combining code points.
Why invisible characters can be legitimate
Invisible does not mean malicious. ZWJ and ZWNJ shape emoji and writing systems; variation selectors choose glyph presentation; word and grapheme controls affect breaking, searching, and collation; and unusual spaces carry real typographic semantics. Findings use Expected, Review, and Suspicious language rather than a misleading risk score.
Bidi and source-code risks
Bidirectional controls support multilingual text, but they can also make displayed source order differ from logical order. The inspector checks unmatched and unterminated controls, overrides, nesting, and context. See UTS #55, the Trojan Source paper, and GitHub’s bidi warning.
Tags and variation-selector steganography
The tool cautiously reconstructs printable Unicode Tag runs and a common variation-selector byte convention. It excludes recognized emoji tag sequences and labels valid candidates as “Possible decoded payload.” The byte convention is not a Unicode standard. Tag runs are the usual carrier for invisible prompt injection against language models.
Safe-cleaning limitations
Conservative cleanup removes malformed or ineffectual cases and unexpected controls while preserving context-sensitive formatting. Security and Aggressive modes are opt-in. Cleanup is deterministic, previewed, and applied to a copy because removing invisible characters can change emoji, multilingual shaping, line breaking, collation, matching, and mathematical meaning.
Privacy
Inspection, decoding, cleanup, and export occur entirely in your browser. Text, filenames, files, findings, and reports are not sent over the network and are not placed in local storage. The Unicode tables ship with the site, so scans make no runtime data requests.
Methodology and scope
The scanner reports Unicode data version 17.0.0 and follows the “show hidden” principle described in Unicode 17, Chapter 23. Emoji handling follows UTS #51, while character properties and data structure follow UAX #44.
This tool does not provide complete steganalysis. It does not detect homoglyph substitutions, normalization-only differences, third-party arbitrary zero-width alphabets, malware, or authorship. Invisible Unicode findings do not prove that text was written by AI, and removing them does not remove statistical model watermarks.