From a web page, an email, a PDF, a document or an artificial intelligence chat.
Your text stays on this device
The check runs inside this browser tab. The page’s security setting (a Content Security Policy) stops it from connecting to anything, so it has no way to send your text out. Once the page has loaded, switch the wifi off and it keeps working. Opening it in the first place needs a connection.
Read the guide: the words you cannot see are the words your assistant reads.
What can hide in ordinary text
Invisible characters
Characters such as the zero-width space, the zero-width joiner and the word joiner take up no space at all. Copied text often carries a few by accident. Placed on purpose, they can split a word so a filter misses it, or form a pattern that marks which copy of a document someone shared. Finding one does not prove anyone meant harm.
Hidden messages in tag characters
Unicode includes a block of tag characters that mirror ordinary letters and show nothing on screen. On 3 September 2026, Microsoft Security Research described a spam campaign that hid tag characters inside finance words such as “funding” so that keyword filters would miss them. The same characters can carry whole sentences of instructions for an artificial intelligence, which is why the Prompt injection checker decodes them too.
Direction tricks
Some invisible characters change the order in which text is drawn, so a file name such as “invoice_fdp.exe” can appear on screen as “invoice_exe.pdf”. The page takes these out, and keeps the ordinary direction marks used in Arabic, Hebrew and Persian text.
Look-alike letters
Some Cyrillic and Greek letters look exactly like Latin ones. A word that mixes them, such as a fake “Apple” spelt with a Cyrillic “A”, is a trick used in scam messages and fake web addresses, although mixed alphabets also turn up in ordinary text in several languages. The page points out words that mix alphabets, and words written entirely in look-alike letters next to Latin text or a web address, such as “аррӏе.com”. It can swap them for ordinary letters in the clean copy, and it tells you each word it changed.
Tracking codes in links
Links shared from emails, social media and adverts often end with codes such as utm_source, fbclid or gclid. They tell the company where the click came from. Taking them out shares less about you, and the link usually works exactly the same. Open the clean link once to check it goes where you expect.
Questions and answers
What are invisible characters?
They are real characters that take up no space on screen, such as the zero-width space, the zero-width joiner and the byte order mark. Text copied from web pages, emails, documents and artificial intelligence (AI) chats can carry them, often by accident. They can split words so a search or a filter misses them, break passwords and codes, or hide a whole message. A pattern of them can also be used to mark which copy of a text someone shared.
Why does my copied text have strange spaces or broken words?
Text copied from a web page, a PDF or a chat often brings invisible characters and unusual spaces with it, such as no-break spaces and zero-width spaces. They can stop a search from finding a word, break a formula or a password, or make two identical-looking words count as different. Paste the text here and copy the clean version.
How do I remove zero-width spaces from text?
Paste the text into the box on this page and press Check the text. The page lists the hidden characters it found, shows where each one sits, and gives you a clean copy with them taken out. Press Copy the clean text and paste that wherever you need it.
Can text hide a secret message?
Yes. Unicode, the standard that numbers every letter and symbol, has a block called tag characters that mirrors ordinary letters but shows nothing on screen. Software can still read them, so a sentence can carry a second, invisible sentence. This page decodes any it finds and shows you what they say. The same characters are also used, harmlessly, inside the flag emoji for England, Scotland and Wales, and the page leaves those alone.
How do I remove tracking from a link?
Paste the link here and keep “Take tracking codes out of links” ticked. The page takes out the extra parts that tell a company where the click came from, such as utm_source, fbclid, gclid and the tracking parts of X and Amazon links, and keeps the rest of the address. Most links work exactly the same without them. A few websites rely on some of these parts, so open the clean link once to check it goes where you expect.
Will it break emoji or other languages?
No. Some invisible characters do a real job: they join the people in a family emoji, turn a flag into the flag of Scotland, keep Persian, Arabic and Hindi words spelt correctly, and keep right-to-left text in order. The page recognises these, leaves them in the clean copy and tells you how many it kept.
Can it clean a PDF, a Word file or a photo?
This page cleans text. For files, use Remove metadata from a PDF file, Is It Really Blacked Out? for hidden text under black boxes, Remove photo location for photos and Release Check for Word, Excel and PowerPoint files.
Does it cost anything, and do I need to sign in?
No. It is 100% free, with no sign-ups and no tracking, and you can start straight away. UtilForge also sells optional packs separately on Gumroad, and this tool works without them.
What happens to the text I paste?
It stays in this browser tab. The page has a security setting (a Content Security Policy, a rule your browser enforces) that stops it from connecting to anything, so it cannot send your text anywhere. It uses no cookies or storage. Close the tab and the text is gone. You can test it: once the page has loaded, switch the wifi off and it keeps working. Opening the page in the first place needs a connection.
Who made this?
UtilForge.org, a registered 2026 Champion of Cybersecurity Awareness Month, which makes free cybersecurity tools for a safer online world for all. The About page explains why the tools exist.