Reveal hidden & confusable Unicode
Paste text to expose invisible characters — zero-width spaces, bidirectional controls (the Trojan-Source code-review risk), variation selectors, no-break spaces — and to flag confusable homoglyphs and mixed-script strings used in phishing and spoofed identifiers. Every finding is named, located by position, and classified. Strip what you choose and see a full audit of exactly what was removed.
Your text never leaves this device. There is no server, no upload, and no network request of any kind — every check runs in your browser, offline once the page has loaded.
Text to inspect
Annotated view
Hidden characters become a labeled chip; confusables stay visible but highlighted. Hover or focus any mark for its name.Findings
No hidden or control characters found.
Confusables & scripts
Strip & clean
Choose which classes to remove, then strip. No-break spaces are normalized to a regular space, not deleted.Audit — what changed
What it can — and can't — tell you
What it does. The inspector names every hidden codepoint in your text — zero-width
spaces, word joiners, BOMs, bidirectional controls, no-break spaces, soft hyphens, variation
selectors — with its official Unicode name, its position, and its class. It also flags
confusable homoglyphs (the pаypal problem, where the а is Cyrillic
U+0430, not Latin a) and tells you when a string mixes writing systems. Stripping
is audited: you see exactly what was removed, normalized, or deliberately kept.
When you'd use it. Three jobs: debugging a string that refuses to compare equal or parse (a stray U+200B or U+00A0 is the classic invisible culprit); security review of source code and commits for Trojan-Source bidi attacks (CVE-2021-42574); and phishing analysis of suspicious domains, usernames, and display names.
Honest limits. Confusable detection is data-table-bound: a character is flagged only
if it appears in the pinned Unicode UTS #39 table (v17.0.0, 6,565 mappings), so novel or
un-tabled look-alikes pass unflagged, and two "confusable" glyphs may render distinctly in
your particular font. Plain ASCII is the reference alphabet and is never itself reported —
rn vs m style ASCII-on-ASCII tricks need a skeleton comparison of
the two whole strings, not this per-character scan. The mixed-script signal is a heuristic
over the whole string: genuinely multilingual text mixes scripts too, and the strongest
phishing signal — mixing inside one identifier-like token — is a judgment this page
leaves to you.
Deliberate strip behavior. No-break spaces are normalized to a regular space, not deleted (deleting one would silently join words). A zero-width joiner that glues a well-formed emoji sequence (👨👩👧) is kept by default so the emoji survives — it is still named in the findings and listed in the audit, never silent. And lone UTF-16 surrogates are not flagged at all: they are category Cs, outside the pinned control/format table.