Invisible Character Detector

This is a configured scan, not a check for every possible invisible Unicode character. The Name column uses the detector's local names or generated labels, so a label is not always an official Unicode name. Characters outside the table and ranges may not be reported.

How to use the Invisible Character Detector

1. Paste text into the text area with the placeholder Paste text to scan for invisible characters....
2. To read a file, select Upload or drop a supported text file onto the input area. The shared uploader accepts .txt, .csv, .log, and .md files (plus files reported as text/plain), and reads the first accepted file.
3. Review Highlighted Preview. Flagged characters are replaced with labeled tags colored by their assigned risk level.
4. Read the Detection Report to inspect each finding, then use Copy Clean Text, Copy Report, or CSV as needed.

Understand the detection report

Each finding includes these fields:

• Code Point: The code point, such as U+200B.
• Name: The name or label reported by the detector.
• Category: The finding's category, such as Control, Space, Format, Zero-Width, Bidi, Variation, or Tag.
• Position: A 1-based character position calculated while iterating the text with Array.from.
• Risk: A predefined high, medium, or low label assigned to the character or category. It is not a contextual security assessment and does not prove malicious intent.
• Guidance: Advice generated from the finding category.

Before text is entered, the preview shows Preview will appear here... and the report shows Paste text to see detected hidden characters. A scan with no matches displays No hidden characters found.

Copy cleaned text or export the report

• Copy Clean Text removes every character flagged by the detector and copies the remaining text to the clipboard. Review the report first: this can remove intentional low-risk spaces, variation selectors, zero-width joiners, and other flagged characters.
• Copy Report copies tab-separated text with the headers Code Point, Name, Category, Position, Risk, and Guidance.
• CSV downloads the findings as invisible-character-report.csv.

Copy Report and CSV do nothing when the current scan has no findings.

Processing limits and local behavior

Scanning and file reading run in browser-side JavaScript. The page states that pasted or uploaded text is not sent to a server. The detector only reports characters in its configured table and ranges; it does not verify intent, assess contextual security impact, or connect to another application.

The local implementation does not define a maximum text length or file-size limit. The shared uploader filters dropped and selected files using the accepted text extensions and MIME type, reports read or cancelled-file errors beside the input, and reports unavailable or denied clipboard access after an export attempt.

Frequently Asked Questions (FAQs)