output lies unreviewed

Bring your own text

Paste anything. See what is hiding.

Type or paste a URL, a filename, a diff line, a copied command. This surfaces every codepoint that is not plain printable ASCII: bidi overrides, zero-width characters, homoglyphs, control bytes. It runs entirely in your browser; nothing is transmitted.

The x-ray

Paste below, or load a trap. Flagged codepoints are chipped inline.

bidi override zero-width control byte deceptive space non-ASCII / homoglyph

A browser aid, not the last word

This teaching demo runs entirely in your browser. It names hidden control, bidi, zero-width and deceptive-space characters, and resolves homoglyphs to the ASCII character they imitate -- Cyrillic, Greek and Armenian look-alikes, fullwidth forms, and the mathematical alphabets, exact code point by code point. It still cannot judge intent, cannot catch all-ASCII look-alikes (rn vs m), and does not do word-level mixed-script analysis. For authoritative work use unicode-show.

Build a trap

See how little effort it takes. Type something honest, pick a disguise, and watch it become a lie the eye cannot catch. Everything here is benign and stays in your browser.

Why show this?

Because "just look carefully" is not a defense. Forging a convincing lie takes one function and a lookup table; catching it by eye is impossible. The payloads here are harmless demonstrations, benign by design. Do not use them to deceive anyone.

Safe-paste sandbox

A preview of secure-terminal: a place where paste is safe by construction. Paste anything below. The left is what arrives; the right is what a terminal that accepts only printable ASCII would keep.

Nothing pasted yet. Type or paste above and the two views appear side by side: what you pasted (every byte, with hidden codepoints chipped) next to what a safe terminal keeps (printable ASCII only).

Test your own tool

The interesting question is not this page. It is whether the tools you already trust warn you.

Load a trap above, copy it, and paste it into the things you make security decisions in. A safe tool either refuses to hide the character or flags it; a deceptive one renders the lie silently.

  • Your terminal: does cat a file named with the bidi trap show the real name? (Kicksecure's stcat and unicode-show do.)
  • Your editor / IDE: paste the bidi filename or the homoglyph URL. Does it warn, or render it clean? (Post-Trojan-Source, many now warn on bidi controls.)
  • Your code review (web): open a diff containing the zero-width or bidi payload. GitHub and GitLab now surface bidi warnings; older or self-hosted tools may not.
  • Your chat / issue tracker: does the homoglyph URL become a clickable link to the spoofed domain?

The lesson is not "distrust everything". It is "know which of your tools surface bytes and which render lies", and route anything security-relevant through the ones that surface.

Tool (defaults, 2026)Bidi overrideZero-widthHomoglyph
VS Code warns docs warns docs warns docs
GitHub / GitLab web diff warns (banner) GitHub, GitLab renders silently tested renders silently tested
Plain terminal (xterm, gnome-terminal) gnome-terminal reorders; xterm does not VTE, survey invisible U+200B renders UTS #39
Editor without a Unicode lint renders Trojan Source invisible Trojan Source renders CVE-2021-42694
unicode-show / stcat detects / neutralizes docs detects / neutralizes docs detects / restricts docs

Defaults as of 2026-07; behaviour varies by version and configuration, which is exactly why the list above says test your own. VS Code has flagged invisible and confusable characters by default since its 1.63 "unicode highlighting"; GitHub and GitLab added bidi warning banners after Trojan Source, but those banners cover bidirectional controls only -- zero-width and confusable characters were still unflagged in the most recent public testing. The row that never lies to you is the last one.

FAQ

Does what I paste get sent anywhere?

No. The analysis runs entirely in your browser in JavaScript: nothing you paste is transmitted, logged or stored, and the page makes no network request with your input. Disconnect from the network and it still works.

Is it safe to paste sensitive text here?

Your text does not leave your machine, so this page will not expose it. The usual browser caveats still apply (a compromised browser or extension can read any page you have open), but nothing here uploads what you paste.

Is the source available?

Yes. The whole site is static HTML, CSS and JavaScript on GitHub - read it, save the page, run it offline.

Was this built with AI?

Yes: this page and its analyzer are AI-assisted.