What you see is not always what's there

The text on your screen can lie to you.

A diff, a terminal, a log: each renders raw bytes as instructions. Hidden characters reorder code, escape sequences forge output, look-alikes pass for the real thing. Here are the tools that make text honest again, and the demonstrations that prove why you need them.

you readpaypal.com

the bytespаypаl.com -- U+0430 Cyrillic a, twice

Safe text tools See the examples

reveal / neutralize / sanitize / review: all safe to open

Explore

Where text lies to you, the tools that surface it, and ways to test yourself.

Terminal / logs

cat lies too

Raw bytes can hide text, forge your prompt, or disguise a character. unicode-show, stcat and sanitize-string, side by side with plain cat.

See the tools ->

Code review

git diffs lie

A safe, browsable set of adversarial git-diff examples: one surprise per branch. What you see vs what git really applies, issue by issue, with the safe review tools that catch each one.

Open the examples ->

Copy / paste

paste lies

A command copied from a web page can carry hidden lines and invisible characters you never saw, and a newline that runs them on paste. See it safely, then learn the safe-copy habit.

See the demo ->

Playground

x-ray anything

Paste a URL, filename, diff line or command and see every hidden codepoint dissected in your browser: bidi, zero-width, homoglyphs, control bytes.

Analyze text ->

Test yourself

spot the lie

Six real strings, rendered the way your tools would show them. Can you tell the honest ones from the traps? Guess, then reveal the raw bytes.

Take the quiz ->

The idea

Rendering is trust

Whenever a tool turns bytes into something on your screen, it makes a trust decision. An attacker who controls those bytes (in a commit, a log line, a filename, a fetched branch name) can target that rendering so what you see differs from what actually happens. The fix is the same everywhere: neutralize the dangerous bytes, name every anomaly out loud, and fail closed when you can't be sure.

Tools: helper-scripts (safe text) and developer-meta-files (git review). Docs on the Kicksecure wiki .

Case files

Not hypothetical. Each earned a CVE or a name and changed how tools behave; some are in active real-world use, others are researcher disclosures with no confirmed in-the-wild abuse. Each case says which.

Trojan Source - a backdoor your eyes cannot see

2021, CVE-2021-42574 (bidi) and CVE-2021-42694 (homoglyph), Boucher & Anderson at Cambridge. Bidirectional-override characters placed in source comments and strings reorder how code displays without changing how the compiler reads it. A reviewer sees an early return or a harmless comment; the compiler sees logic that ships a backdoor. It hit nearly every compiler and language at once, because the deception lives in the text layer, below the language.

The fix: compilers and linters now warn on bidi controls in source; GitHub shows a warning banner on affected files and GitLab highlights the characters inline. Catch it before merge with unicode-show and check-ref-commits-for-unicode.

Source: trojansource.codes (CVE-2021-42574, CVE-2021-42694).

Homoglyph domains - a padlock on the wrong site

A registrable look-alike: аpple.com begins with U+0430 CYRILLIC SMALL LETTER A, not Latin a. It is a different domain that can hold its own valid TLS certificate and padlock. Xudong Zheng's 2017 proof-of-concept registered a Cyrillic apple.com that Chrome and Firefox then displayed indistinguishably from the real one.

The fix: Chrome, Safari and Edge now show the punycode form (xn--...) for confusable domains, though Firefox still renders whole-script Cyrillic look-alikes by default; registrars also restrict mixed-script registrations. The same trick still works on package names and command names, which have no such guard.

Source: xudongz.com - Phishing with Unicode Domains.

Pastejacking - you copied one command, you ran another

2016, Dylan Ayrey. A command shown on a web page is copied, but a JavaScript copy handler (or CSS-hidden text, or a trailing newline) places something else on your clipboard. Paste it into a terminal and a hidden trailing newline runs it immediately, before you can read it.

The fix: paste into an editor first, never straight into a shell; enable bracketed paste so a pasted newline cannot auto-execute; and treat every "copy" button as untrusted. There is a live, safe demonstration on the Paste page.

Source: github.com/dxa4481/Pastejacking.

Cheat sheet

The dangerous character classes, what each does, and how to catch it. Paste any example into Analyze to see it live.

Class	Examples	What it does	Catch it
Bidi controls	`U+202A`-`202E`, `U+2066`-`2069`	Reorder display vs byte order (Trojan Source)	`unicode-show`; editor / host warnings
Zero-width	`U+200B` ZWSP, `U+200C/D`, `U+FEFF`	Invisible; split or join tokens, hide in URLs and identifiers	any codepoint dump
Homoglyphs	`U+0430` Cyrillic a, `U+03BF` Greek o	Look identical to ASCII; spoof domains, packages, commands	confusable check; restrict to ASCII
ASCII look-alikes	`rn` = m, `l 1 I`, `0 O`	No Unicode at all; the eye does the work	read character by character (a Unicode tool cannot help)
Control bytes	`U+0000`-`001F`, `U+007F`, C1	NUL truncation, escape injection, prompt forging	`stcat` strips them before display
ANSI / OSC-8	`ESC[...m`, `ESC]8;;`	Recolour or overwrite output, forge log lines, hide a link target; and, in a vulnerable terminal, a 20-year RCE class (a reflected query can inject keystrokes)	`stcat`; allow only safe SGR
Combining marks	`U+0300`-`036F`	Stack onto letters (Zalgo), overflow, disguise	normalise; length-limit
Fullwidth forms	`U+FF01`-`FF5E`	Wide look-alikes of ASCII letters and punctuation	flag non-ASCII

The lie ends at a safe terminal

These pages show you how text lies and hand you the tools to catch it. secure-terminal is the next step: a terminal where a pasted lie has nothing to hide in, printable-ASCII by construction, and now working.

secure-terminal Analyze text Take the quiz