Free text forensics

Hidden Text


Reveal the invisible characters, lookalike letters and hidden fingerprints inside any text, decode hidden messages, and copy a clean version.

Open text file
Checked in your browser. Your text is never uploaded or stored.

Questions

What are zero-width characters?

Unicode characters that take up no space, such as the zero-width space. They have real uses: joining letters in Persian and Indian scripts, and building emoji like 👨‍👩‍👧. They are also used to hide messages, fingerprint documents and split words so filters miss them. This tool tells the two apart.

How can hidden characters trace a leak?

An organisation can give each person a copy with a slightly different pattern of invisible characters, unusual spaces or lookalike letters. If the text leaks, the pattern shows whose copy it was. Comparing two copies here shows exactly where they differ. Retyping the text, or using the clean copy, removes these marks; other fingerprinting methods, such as small wording changes, need a closer read.

What are lookalike letters?

Letters from other alphabets that look the same as English ones, such as the Cyrillic “а” and the Latin “a”. They are used in fake web addresses, to get messages past keyword filters, and to fingerprint text. Real Russian or Greek text is not flagged; only foreign letters hiding inside English words are.

What is a text-direction override?

An invisible character that makes the following text display right to left. It can make a file called “reportfdp.exe” appear as “reportexe.pdf”, or make program code look different from what actually runs (known as a Trojan Source attack).

Can it decode every hidden message?

It decodes the common schemes: zero-width binary, Unicode tag characters and variation-selector data. Tools that encrypt or compress the hidden data cannot be read without the key, but the invisible characters are still detected and can be removed.

Check the privacy claim yourself

  1. Open your browser's developer tools and select the Network tab.
  2. Paste text and check it. No new requests appear: everything happens on your device.
  3. Or disconnect from the internet after this page loads. The detector keeps working.