What is a Trojan Source attack?

Unicode bidirectional controls such as RLO (U+202E), LRI (U+2066) and PDI (U+2069) exist for mixing left-to-right and right-to-left text on one line. Trojan Source (CVE-2021-42574), disclosed in 2021, abuses them so that editors and code review tools display code in a different order from what the compiler reads — for example hiding a condition inside what looks like a comment. This tool marks every bidi control and checks, line by line, that embeddings and overrides are closed by PDF and isolates by PDI, warning about any that aren’t.

Why look for homoglyphs?

Many scripts contain letters that look exactly like Latin ones: Cyrillic а, е, о, р and с are visually identical to a, e, o, p and c but have different code points. Attackers use them for lookalike domains, fake usernames and slipping past keyword filters. The tool flags them inside words that contain Latin letters, or when a whole word is made of Latin lookalikes, and can replace them with the matching Latin letters. Genuine Russian or Greek text isn’t flagged.

Will cleaning break emoji or Chinese text?

Not by default. The ZWJ inside emoji sequences (such as family emoji) and the VS16 variation selector are legitimate, so they’re neither flagged nor removed unless you ask. Full-width Chinese punctuation isn’t treated as a problem, and the ideographic space is kept unless you tick that option. Only the Strictest preset applies NFKC, which turns ﬁ into fi, ① into 1 and full-width symbols into ASCII — good for code and identifiers, not for typeset prose.

What’s the difference between NFC and NFKC?

The same glyph can have several Unicode encodings — é can be one code point or an e followed by a combining accent. NFC converts them to the composed form without changing how text looks, which suits most text and prevents strings that look identical from comparing as different. NFKC also applies compatibility mappings, turning full-width letters, superscripts, ligatures and circled numbers into plain characters. That may change the appearance, so it’s best for usernames, search keys and code.

👻

👻Invisible Character Detector - Zero-Width & Trojan Source

Text copied from web pages, chats or documents often carries characters you can’t see. A zero-width space breaks search and comparisons, a stray BOM breaks config parsing, a non-breaking space causes a syntax error, a soft hyphen hides inside a word, bidirectional controls can make source code display in a different order from what the compiler reads (the Trojan Source attack), and a Cyrillic “а” posing as a Latin “a” can spoof URLs and usernames. This tool inspects text character by character. It finds zero-width characters (ZWSP, ZWNJ, ZWJ, WJ, BOM and more) and bidi controls (LRE, RLE, LRO, RLO, PDF, LRI, RLI, FSI, PDI, LRM, RLM), and checks line by line that they’re balanced. It also flags unusual spaces (NBSP, ideographic space, em space…), soft hyphens, C0/C1 control characters, tag characters, variation selectors, full-width letters and digits, and stacked combining marks (Zalgo text). A compact confusables table catches Cyrillic, Greek, Armenian and Cherokee lookalikes, along with words that mix scripts. Chinese mixed with English, normal full-width CJK punctuation and emoji sequences don’t trigger false alarms. Findings appear as colored markers in your text, with invisible ones shown by name; click one for its code point, name, general category, script, UTF-8/UTF-16 encoding and position. Clean up with a preset or individual options plus NFC/NFKC normalization, review a before/after diff and copy the result. Everything runs locally in your browser.

Free · No sign-up · Runs in your browserLast updated: 2026-10-26

Loading tool...

How to use Invisible Character Detector

1Paste the text, code, URL or username you want to check
2Review the category counts, Trojan Source warnings and marked view; click a marker for character details
3Pick a cleaning preset or individual options, check the before/after diff, then copy the result or replace the input

FAQ

What is a Trojan Source attack?: Unicode bidirectional controls such as RLO (U+202E), LRI (U+2066) and PDI (U+2069) exist for mixing left-to-right and right-to-left text on one line. Trojan Source (CVE-2021-42574), disclosed in 2021, abuses them so that editors and code review tools display code in a different order from what the compiler reads — for example hiding a condition inside what looks like a comment. This tool marks every bidi control and checks, line by line, that embeddings and overrides are closed by PDF and isolates by PDI, warning about any that aren’t.
Why look for homoglyphs?: Many scripts contain letters that look exactly like Latin ones: Cyrillic а, е, о, р and с are visually identical to a, e, o, p and c but have different code points. Attackers use them for lookalike domains, fake usernames and slipping past keyword filters. The tool flags them inside words that contain Latin letters, or when a whole word is made of Latin lookalikes, and can replace them with the matching Latin letters. Genuine Russian or Greek text isn’t flagged.
Will cleaning break emoji or Chinese text?: Not by default. The ZWJ inside emoji sequences (such as family emoji) and the VS16 variation selector are legitimate, so they’re neither flagged nor removed unless you ask. Full-width Chinese punctuation isn’t treated as a problem, and the ideographic space is kept unless you tick that option. Only the Strictest preset applies NFKC, which turns ﬁ into fi, ① into 1 and full-width symbols into ASCII — good for code and identifiers, not for typeset prose.
What’s the difference between NFC and NFKC?: The same glyph can have several Unicode encodings — é can be one code point or an e followed by a combining accent. NFC converts them to the composed form without changing how text looks, which suits most text and prevents strings that look identical from comparing as different. NFKC also applies compatibility mappings, turning full-width letters, superscripts, ligatures and circled numbers into plain characters. That may change the appearance, so it’s best for usernames, search keys and code.