Unicode Inspector — Reveal Invisible Characters & Homoglyphs
The Unicode Inspector reveals what plain text hides. Paste any string and it highlights invisible and zero-width characters, flags letters from other scripts that impersonate ASCII (homoglyphs), and breaks the text down code point by code point with hex, decimal, and Unicode general category. It is built for developers debugging mysterious parsing failures, security-minded users checking links and names for spoofing, and writers cleaning text pasted from word processors, PDFs, or chat apps.
Everything runs locally in your browser with JavaScript — the text you paste is never uploaded, stored, or sent to a server — so it is safe to inspect private code, credentials, or unpublished writing.
How to use Unicode Inspector
- Paste or type text into the input box, or press Load sample to see the tool in action.
- Read the summary tiles for a quick count of code points, UTF-16 units, UTF-8 bytes, invisible characters, confusables, and non-ASCII characters.
- Scan the Revealed text panel: every invisible character becomes a labeled marker (such as ZWSP or NBSP) and every look-alike letter is underlined in red. Hover a marker to see its name and code point.
- Open the Invisible and Confusable tables for an exact list of what was found, with counts and code points.
- Use the Code point breakdown table to inspect each character, and toggle Hide plain ASCII to focus on the unusual ones.
- Press Copy cleaned to strip zero-width and formatting characters (unusual spaces become a normal space), or Copy ASCII to also replace look-alike letters with their plain ASCII equivalents.
What counts as an invisible character
Invisible characters take up no width, or look like an ordinary space, yet change how text is stored, searched, and rendered. The inspector flags the following groups and labels each one where it appears:
- Zero-width characters — Zero Width Space (U+200B), Zero Width Non-Joiner (U+200C), Zero Width Joiner (U+200D), and Word Joiner (U+2060).
- Byte Order Mark / Zero Width No-Break Space (U+FEFF), often left at the start of files.
- No-Break Space (U+00A0) and other unusual spaces — narrow, thin, hair, figure, and ideographic spaces that masquerade as a normal space.
- Bidirectional controls — LRM and RLM, the embedding and override characters (U+202A to U+202E), and the isolate characters (U+2066 to U+2069) used in Trojan Source style tricks.
- Soft hyphen (U+00AD), other Unicode format (Cf) characters, control characters, and line or paragraph separators (U+2028 and U+2029).
- Tag characters (U+E0000 to U+E007F) and variation selectors, sometimes used to hide metadata or watermarks in text.
Homoglyphs and confusables
A homoglyph is a character that looks like another but has a different code point. The Cyrillic small letter a (U+0430) is visually identical to the Latin a (U+0061). Swapping one for the other is the basis of IDN homograph phishing, where a fake domain looks like a real one, and of copy-paste bugs where an identifier silently fails to match.
The inspector flags characters that impersonate ASCII letters and digits and shows the ASCII character each one mimics. Detection combines a curated map of the most-abused Cyrillic, Greek, and Latin look-alikes with Unicode NFKC compatibility folding, which also catches fullwidth forms, mathematical alphanumeric styles, and letter-like symbols.
Latin a = U+0061 Cyrillic a = U+0430 (looks identical, different code point)
Honest limits of confusable detection
Confusable detection here is a strong heuristic, not the complete Unicode confusables database. It focuses on characters that impersonate ASCII, so a look-alike between two non-Latin scripts may not be flagged, and unusual or newly added confusables can be missed. Treat a clean result as nothing common found, rather than a guarantee, and use the code point table to verify anything suspicious.
Code points, UTF-16 units, and bytes
The inspector iterates text by Unicode code point, not by UTF-16 code unit, so emoji and other characters above U+FFFF (the astral planes) are counted and listed as a single character. That is why the three size numbers can differ: an emoji is one code point, two UTF-16 units, and four UTF-8 bytes.
For every character the breakdown table shows the glyph, the U+XXXX code point, its decimal value, and its Unicode general category (for example Lu for an uppercase letter or Cf for a format character), with a friendly name for the characters the tool knows by name.
A followed by an emoji: A U+0041 dec 65 Lu Uppercase Letter emoji U+1F642 dec 128578 So Other Symbol
Where hidden characters come from
- Copying from Word, Google Docs, Slack, or a PDF, which can inject soft hyphens, non-breaking spaces, and direction marks.
- AI-generated text that carries watermark or formatting characters.
- Deliberate obfuscation — hiding zero-width data in text, or spoofing domains and usernames with look-alike letters.
- Source files with a leftover byte order mark that breaks JSON parsing or shell scripts.
Related terminology
- Code point
- A single Unicode scalar value, written as U+ followed by hex (for example U+0041 for A). The inspector counts and lists text by code point, so astral characters such as emoji count as one.
- Zero-width character
- A character that renders with no width, such as the Zero Width Space (U+200B) or Zero Width Joiner (U+200D). It is invisible on screen but still stored in the text.
- Homoglyph / confusable
- A character that looks like another from a different script or style, such as Cyrillic a (U+0430) versus Latin a (U+0061). Used in phishing and a common source of hard-to-spot text bugs.
- Byte Order Mark (BOM)
- U+FEFF, an invisible character sometimes placed at the start of a file to signal encoding. Left in the wrong place it breaks JSON, CSV, and shell parsing.
- Bidirectional (bidi) control
- Format characters such as U+202E Right-to-Left Override that reorder how text is displayed. Misused, they can make code or file names read differently than they execute.
- General category
- The Unicode property that classifies each code point as a letter, number, punctuation, symbol, separator, or control/format, abbreviated with two letters such as Lu, Nd, or Cf.
- NFKC normalization
- A Unicode normalization form that folds compatibility variants (fullwidth, styled, and letter-like forms) to a base character. The inspector uses it to catch look-alikes beyond its curated map.
Frequently asked questions
- What are invisible or zero-width characters?
- They are Unicode characters that either render with no width or masquerade as an ordinary space, such as the Zero Width Space (U+200B), Word Joiner (U+2060), byte order mark (U+FEFF), and no-break space (U+00A0). You cannot see them, but they affect how text is searched, compared, parsed, and displayed. The inspector reveals each one as a labeled marker.
- How do I remove zero-width or invisible characters from text?
- Paste the text, then press Copy cleaned. Zero-width, formatting, control, and bidirectional characters are removed, and unusual spaces such as a non-breaking space are normalized to a regular space so words are not merged. Use Copy ASCII to additionally replace look-alike letters with plain ASCII.
- What is a homoglyph and why is it dangerous?
- A homoglyph is a character that looks like another but has a different code point, like the Cyrillic a that looks identical to the Latin a. Attackers use them to register look-alike domains and usernames (IDN homograph attacks), and they cause silent bugs where two strings look the same but are not equal. The inspector flags characters that impersonate ASCII and shows which letter each one mimics.
- Does this detect every Unicode confusable?
- No. Detection uses a curated list of the most commonly abused Cyrillic, Greek, and Latin look-alikes plus Unicode NFKC compatibility folding. It is a strong heuristic focused on characters that impersonate ASCII, not the full Unicode confusables database, so treat a clean result as a good sign rather than a guarantee.
- Why is the character count different from the length or byte count?
- The inspector counts by Unicode code point, while UTF-16 units are how JavaScript measures string length and UTF-8 bytes are how the text is stored. Characters above U+FFFF, such as many emoji, are one code point but two UTF-16 units and four UTF-8 bytes, so the three numbers legitimately differ.
- Is my text uploaded to a server?
- No. All detection and inspection run entirely in your browser with JavaScript, so the text you paste never leaves your device — safe for private code, credentials, and unpublished writing.