The Universal Invisible Character Detector & Hidden Unicode Stripper by RiazHub is a modern, high-precision, 100% client-side web utility engineered for software developers, security analysts, and technical writers. It scans, visualizes, and sanitizes hidden zero-width spaces (U+200B), Byte Order Marks (U+FEFF), Non-Breaking Spaces (U+00A0), soft hyphens, and high-risk Unicode Bidirectional (Bidi) Trojan Source overrides (CVE-2021-42574) in real time. Featuring an interactive X-Ray Ghost Inspector canvas, granular code-point diagnostics (codePointAt), customizable sanitization toggles with intelligent Arabic/Persian ligature preservation, and 1-click developer presets, the tool ensures zero-latency detection while keeping all confidential tokens, source code, and API keys strictly private inside your browser without transmitting any data over the network.
Universal Invisible Character Detector & Hidden Unicode Stripper
Inspect, visualize, and sanitize hidden zero-width spaces (ZWSP), Byte Order Marks (BOM), Trojan Source bidirectional overrides (CVE-2021-42574), and invisible copy-paste anomalies in real time.
🔍 Character Inspector
Hidden Unicode Characters, Syntax Bugs & Security Guide
Learn why invisible characters cause catastrophic system bugs, authentication failures, and security vulnerabilities.
Invisible characters like the Zero-Width Space (U+200B) and Byte Order Mark (U+FEFF) occupy zero pixels on screen, making them completely undetectable to the human eye in code editors. However, compilers and interpreters treat them as invalid tokens:
- JavaScript / TypeScript: Causes
SyntaxError: Invalid or unexpected tokeninside identifiers or object keys. - JSON Parsers: Triggers
SyntaxError: Unexpected token in JSON at position 0when a hidden BOM (U+FEFF) precedes the opening bracket{. - Python: Injects ghost indentation or invalid character errors inside docstrings or function signatures.
- API Keys & Tokens: Pasting a secret key with an embedded ZWSP will fail hash checks and produce continuous
401 Unauthorizederrors.
The Trojan Source vulnerability (CVE-2021-42574) exploits Unicode Bidirectional (Bidi) control characters—such as U+202E (RLO - Right-to-Left Override) and U+2066 to U+2069 (Directional Isolates). These characters force human code reviewers to see text in one order while compilers (GCC, Clang, Rust, Go, Python) execute the code in reverse order.
For example, an attacker can place an RLO character inside a comment or string literal, causing what appears to be a harmless comment to visually encompass and comment-out critical security authorization checks during pull request review.
Rich text editors like Microsoft Word, Google Docs, Apple Pages, and PDF readers apply automatic typographic enhancements:
- Non-Breaking Spaces (
U+00A0): Used to prevent orphaned words at the end of lines. When copied into terminal shells or code editors, they triggercommand not foundor syntax errors because they do not match standard ASCII space (0x20). - Soft Hyphens (
U+00AD): Inserted for automatic word wrapping. When copied, they remain embedded inside words and corrupt database search indexes.
Invisible Unicode variation selectors, Hangul fillers (U+3164), and Tag characters (U+E0000 to U+E007F) can encode hidden binary data directly inside plain text. Malicious actors use this technique for:
- Invisible LLM Prompt Injections: Hiding jailbreak prompts or data-exfiltration commands inside text that appears completely benign to human operators.
- Watermarking & Leak Tracking: Secretly embedding user IDs or tracking payloads into shared proprietary documents without visual indication.
This utility runs entirely inside your browser using JavaScript code point iterators (codePointAt() and Array.from()). No text, credentials, passwords, or source files are ever sent over the network or stored on any server. You can safely inspect confidential tokens, private keys, and proprietary algorithms with complete peace of mind.