# Invisible Character Detector - Zero-Width & Trojan Source

> Detect and remove zero-width characters, bidi controls (Trojan Source), non-breaking spaces, soft hyphens, control chars, homoglyphs and full-width letters.

- URL: https://qilingtools.com/en/invisible-chars
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Text](https://qilingtools.com/en/tags/text), [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Developer](https://qilingtools.com/en/tags/dev)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

Text copied from web pages, chats or documents often carries characters you can’t see. A zero-width space breaks search and comparisons, a stray BOM breaks config parsing, a non-breaking space causes a syntax error, a soft hyphen hides inside a word, bidirectional controls can make source code display in a different order from what the compiler reads (the Trojan Source attack), and a Cyrillic “а” posing as a Latin “a” can spoof URLs and usernames. This tool inspects text character by character. It finds zero-width characters (ZWSP, ZWNJ, ZWJ, WJ, BOM and more) and bidi controls (LRE, RLE, LRO, RLO, PDF, LRI, RLI, FSI, PDI, LRM, RLM), and checks line by line that they’re balanced. It also flags unusual spaces (NBSP, ideographic space, em space…), soft hyphens, C0/C1 control characters, tag characters, variation selectors, full-width letters and digits, and stacked combining marks (Zalgo text). A compact confusables table catches Cyrillic, Greek, Armenian and Cherokee lookalikes, along with words that mix scripts. Chinese mixed with English, normal full-width CJK punctuation and emoji sequences don’t trigger false alarms. Findings appear as colored markers in your text, with invisible ones shown by name; click one for its code point, name, general category, script, UTF-8/UTF-16 encoding and position. Clean up with a preset or individual options plus NFC/NFKC normalization, review a before/after diff and copy the result. Everything runs locally in your browser.

## How to use

1. Paste the text, code, URL or username you want to check
2. Review the category counts, Trojan Source warnings and marked view; click a marker for character details
3. Pick a cleaning preset or individual options, check the before/after diff, then copy the result or replace the input

## Features

- Detects zero-width spaces, joiners, BOM and word joiners
- Bidi control detection with per-line balance checks (Trojan Source)
- NBSP, ideographic and other unusual spaces, plus soft hyphens
- Control characters, tag characters, variation selectors and Zalgo marks
- Cyrillic, Greek, Armenian and other homoglyphs; mixed-script words
- Full-width ASCII detection without flagging emoji or CJK punctuation
- Code point, name, category, script and UTF-8/UTF-16 details
- Cleaning presets, NFC/NFKC normalization and a before/after diff

## FAQ

### What is a Trojan Source attack?

Unicode bidirectional controls such as RLO (U+202E), LRI (U+2066) and PDI (U+2069) exist for mixing left-to-right and right-to-left text on one line. Trojan Source (CVE-2021-42574), disclosed in 2021, abuses them so that editors and code review tools display code in a different order from what the compiler reads — for example hiding a condition inside what looks like a comment. This tool marks every bidi control and checks, line by line, that embeddings and overrides are closed by PDF and isolates by PDI, warning about any that aren’t.

### Why look for homoglyphs?

Many scripts contain letters that look exactly like Latin ones: Cyrillic а, е, о, р and с are visually identical to a, e, o, p and c but have different code points. Attackers use them for lookalike domains, fake usernames and slipping past keyword filters. The tool flags them inside words that contain Latin letters, or when a whole word is made of Latin lookalikes, and can replace them with the matching Latin letters. Genuine Russian or Greek text isn’t flagged.

### Will cleaning break emoji or Chinese text?

Not by default. The ZWJ inside emoji sequences (such as family emoji) and the VS16 variation selector are legitimate, so they’re neither flagged nor removed unless you ask. Full-width Chinese punctuation isn’t treated as a problem, and the ideographic space is kept unless you tick that option. Only the Strictest preset applies NFKC, which turns fi into fi, ① into 1 and full-width symbols into ASCII — good for code and identifiers, not for typeset prose.

### What’s the difference between NFC and NFKC?

The same glyph can have several Unicode encodings — é can be one code point or an e followed by a combining accent. NFC converts them to the composed form without changing how text looks, which suits most text and prevents strings that look identical from comparing as different. NFKC also applies compatibility mappings, turning full-width letters, superscripts, ligatures and circled numbers into plain characters. That may change the appearance, so it’s best for usernames, search keys and code.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.