Unicode Inspection · Zero-Width Spaces · Code Sanitizer

Invisible Character Detector

Detect and sanitize insidious zero-width spaces, non-breaking spaces (NBSP), and invisible Unicode formatting ghosts that break compilers and queries.

Presets:

Paste Text to Inspect for Invisible Ghosts126 chars · 7 lines

⚠

Detected 2 Invisible Characters

Hidden characters can cause silent build errors, SQL failures, or variable mismatches.

Zero-Width Space:×2

Visual Position InspectorHighlighted blocks show exact ghost locations

const userU+200BId = "admin_982"; function verify(userU+200BId) { if (userId === "admin_982") { return true; } return false; }

Character Coordinates & Context

Line:Col	Unicode	Character Name	Context Preview
L1:C11	U+200B	Zero-Width Space	const user[U+200B]Id = "admin_
L2:C21	U+200B	Zero-Width Space	verify(user[U+200B]Id) { if (

Sanitization Filters

Strip Zero-Width Chars (\u200B, \u200C, \u200D)Convert NBSP to Normal SpacesStrip Byte Order Mark (BOM \uFEFF)Remove Soft Hyphens (\u00AD)Strip Non-Printable Control Chars

Why Hidden Unicode Characters Break Software & How to Prevent Them

The Mystery of "Ghost" Build & Syntax Failures

One of the most frustrating developer debugging nightmares occurs when code appears visually flawless on screen, yet the compiler throws bizarre syntax errors:

Variable Identity Collisions: In JavaScript and Python, inserting a Zero-Width Space (\u200B) inside an identifier (e.g. userId) creates a distinct symbol from userId. Two variables will render identically to human eyes while pointing to different memory addresses!
BOM in JSON & Node.js: The Byte Order Mark (\uFEFF) at the start of JSON configuration files causes JSON.parse() and strict schema validators to crash with Unexpected token \uFEFF in JSON at position 0.
NBSP in CLI Commands: Copying bash scripts or Docker commands from blogs frequently replaces ASCII spaces (0x20) with non-breaking spaces (\u00A0), causing shells to fail with "command not found".

Security Vulnerabilities & Homoglyph Attacks

Invisible characters are not merely accidental artifacts—malicious actors weaponize them in social engineering and supply chain attacks:

Steganography & Watermarking: Insiders can encode binary exfiltration payloads into seemingly innocuous emails using binary patterns of zero-width spaces and zero-width non-joiners.
WAF & SQLi Filter Evasion: Web Application Firewalls (WAFs) looking for SELECT * FROM can be bypassed if an attacker interleaves \u200B between SQL keywords that the SQL engine strips or tolerates.
Phishing Usernames: Adversaries register usernames on social platforms or chat apps containing zero-width spaces to impersonate legitimate brand accounts or staff members.

Sanitization Protocols for Production Pipelines

Ensure your CI/CD linters include rules to reject non-printable Unicode in source trees (e.g., ESLint no-irregular-whitespace and Git pre-commit hooks). Always sanitize customer input in webhook ingestion and CMS pipelines by normalizing Unicode via string.normalize('NFKC') and regex-stripping invisible ranges before database insertion.