Why it matters
Text can hide things. A zero-width space breaks a search or a password; a non-breaking space stops a CSV import matching; a Cyrillic 'а' makes 'pаypal.com' a different domain; and bidirectional control characters can make source code display in a different order from how it runs, the 'Trojan Source' attack.
This inspector shows every code point with the browser's own Unicode data, counts the string the four ways that matter (graphemes, code points, JavaScript length and UTF-8 bytes) and flags anything hidden or deceptive, then gives you a cleaned copy.
How it works
- InputText from anywhere
- In your browserEvery code point named and checked
- OutputHidden, look-alike and bidi characters, and a clean copy
Where it fits in a designer's workflow
- Plan
- Design
- Build
- Test
- Launch
By the numbers
Show the numbers as a table
| Measure | Count |
|---|---|
| Code points | 40 |
| What you see (graphemes) | 37 |
| UTF-16 units (JavaScript .length) | 43 |
| UTF-8 bytes | 59 |
| Invisible characters | 2 |
| Bidi controls | 1 |
| Look-alike letters | 1 |
How to use it
- Paste the text, or try an example.
- Read the findings for hidden or look-alike characters.
- Check each code point in the table.
- Copy the cleaned or escaped text.
FAQ
Why are the lengths different?
An emoji like 👩🏽💻 is one visible character but several code points and more UTF-16 units. Databases often count bytes, JavaScript counts UTF-16 units, and people count graphemes.
What's Trojan Source?
A 2021 attack (CVE-2021-42574) that hides bidirectional control characters in code so a reviewer sees different logic from what the compiler runs.
Why not show character names for everything?
Full names need a large data file. Names are given for the invisible, space and punctuation characters that matter here; the code point identifies the rest.
What does NFC do?
It combines letters and accents into single code points where possible, so 'é' typed two ways compares equal. Normalise user input before comparing or storing it.
