Guide · Message risk · September 2026

The Text You Can't See

Two messages can look exactly the same and contain completely different characters.

You copy a message.

It looks normal.

Three ordinary sentences. Nothing strange.

You paste it into a document, a website, a wallet, or an AI assistant.

And suddenly something happens that the message, as you saw it, never appeared to say.

How?

Because what you see on your screen isn't necessarily everything that's inside the text.

Some characters take up no visible space at all.

They are still there.

They can still be copied, pasted, stored and processed.

You just can't see them.

Your computer doesn't see letters the way you do

When you look at a sentence, you see shapes.

Your computer sees data.

The letter A, for example, is represented by a Unicode character with a specific code point. A space is another character. Every letter, number, punctuation mark and many other symbols have their own representation.

But not every character produces a visible shape.

Some characters tell software how text should behave.

They can tell a program:

• connect these characters
• don't break the line here
• display this section from right to left
• change how these characters are ordered
• or, in some cases, simply occupy a position without drawing anything

So you can have two pieces of text that look identical while being different sequences of characters.

That difference can matter.

A lot.

Three kinds of invisible text worth knowing

There are several different mechanisms involved, but three are particularly useful to understand.

1. Characters that don't appear

These are often called zero-width characters.

Examples include the zero-width space, zero-width joiner and word joiner.

They occupy a position in the text but don't produce visible pixels.

For example, these two words may look identical:

There is an invisible character inside the second one.

You probably can't see it.

Your computer can.

That means the two strings are not actually identical.

This can affect searches, filters, usernames, identifiers and other systems that compare the underlying characters rather than what a person sees.

And there is a legitimate reason some of these characters exist.

We'll come back to that.

2. Characters that change the order you see

Some invisible characters affect text direction.

This is necessary because languages such as Arabic and Hebrew are written from right to left, while English is written from left to right.

A sentence containing both can require instructions telling the software how different parts should be displayed.

Those instructions can be useful.

But they can also be abused.

A direction-control character can make the characters stored by a computer appear in a different order on screen.

That creates an obvious security problem.

A filename, for example, might look as though it ends with one extension while its underlying character sequence says something different.

The same principle can matter in source code.

A reviewer sees one thing.

The computer processes another.

3. Characters that can carry an invisible message

This is the unusual one.

Unicode contains a range known as the Tags block.

These characters were designed for tagging purposes and are normally invisible when rendered.

The interesting part is that individual tag characters can represent ordinary ASCII characters.

Put enough of them together and they can encode text.

A sentence can therefore contain an additional string of characters that doesn't appear on screen.

To your eyes, the message might look like a completely ordinary greeting.

To software reading the underlying characters, there can be much more there.

And that distinction becomes particularly interesting when the destination is an AI assistant.

An AI doesn't see your message as a photograph of the screen.

It processes the characters.

So something you cannot see can still be part of the input.

Here's what that looks like

Take this sentence:

Send the payment to the address below.

Looks normal, right?

Now imagine that invisible characters have been inserted into it.

On your screen, it can still look like this — and this one is the real thing, prepared for you to test:

But underneath, the computer may actually be holding additional characters.

For example:

The visible sentence hasn't changed.

The underlying string has.

That's the important idea.

Same appearance. Different data.

If you run the specially prepared example through a scanner, the scanner can identify those characters even though your eyes cannot.

Retype the visible sentence manually and those hidden characters don't come with it.

That is the entire trick.

The letter that isn't the letter

Invisible characters aren't the only problem.

Sometimes the character is perfectly visible.

It just isn't the character you think it is.

Consider these two:

They look almost impossible to distinguish.

But look at the second one carefully.

The second character is not the Latin letter a.

It is a Cyrillic а.

They look alike.

They are different characters.

That technique is known as a homoglyph attack.

The same idea can be used with usernames, domain names, token names and other identifiers.

A fake account can use a look-alike character.

A fake website can use a look-alike domain.

To a person, the name can appear familiar.

To a computer, it is a completely different string.

Where can this actually cause problems?

This isn't just a strange Unicode trick.

It matters anywhere text is copied, compared or acted upon.

AI assistants

You paste a message into an AI assistant.

You see a question.

The underlying text may contain characters that aren't visible to you.

Because the assistant processes the actual text, not just the visual appearance, those characters become part of the input.

That's why invisible-character checks can be useful before pasting untrusted text into a system that can take actions or process sensitive information.

Usernames and account names

Two accounts can look as though they have the same name while containing different characters.

That can make impersonation much harder to notice.

Links and domains

A link can contain characters that resemble familiar letters.

The name you recognise isn't necessarily the exact domain you think it is.

Code

Direction-control characters and other unusual Unicode characters can make source code harder to review correctly.

A developer sees the rendered text.

The compiler sees the actual characters.

Search and filtering

A filter is usually comparing strings.

Insert an invisible character and the string changes.

That can affect searches, blocklists, moderation systems and other text-processing tools.

How can you check?

You don't need to become a Unicode expert.

There are a few simple checks.

CHECK 1 — Scan the text

Paste suspicious text into a character-security scanner.

A useful scanner should tell you:

• whether invisible characters are present
• how many were found
• which characters they are
• what Unicode family they belong to
• whether look-alike characters were detected

That's what the scanner on this site is designed to show.

The important part is that it should tell you what it actually found, rather than simply giving you a mysterious green or red light.

CHECK 2 — Compare the character count

This is a quick sanity check.

If a sentence appears to contain 38 characters but a character counter reports 47, you have a difference worth investigating.

A character count won't tell you what the extra characters are.

But it can tell you that something is there that you aren't seeing.

CHECK 3 — Retype text when appropriate

If someone sends you a short instruction and you don't need to preserve the original formatting, manually typing the important part can remove invisible characters from the copied text.

But remember:

Retyping does not make the destination trustworthy.

If someone sends you a suspicious website address, for example, manually typing it doesn't prove that the website itself is legitimate.

It's simply a way of avoiding hidden characters in the text you copy.

CHECK 4 — Read the actual domain

Don't rely only on recognising how a domain looks.

If a link matters, check the actual domain.

For important accounts, use a bookmark you've already saved or type the known address yourself instead of following an unexpected link.

The same principle applies to usernames and wallet addresses:

recognising the shape isn't the same as verifying the characters.

Don't panic when you find an invisible character

This is important.

Invisible does not automatically mean malicious.

Some invisible Unicode characters exist because people genuinely need them.

Zero-width joiners, for example, can affect how characters connect in various writing systems.

They are also used in emoji sequences.

Direction-control characters are necessary for correctly displaying text that mixes left-to-right and right-to-left scripts.

So finding an invisible character does not automatically mean:

"This is an attack."

It means:

There is something here that I can't see.

What that means depends on the context.

Who sent the text?

What does the text ask you to do?

Where are you about to paste it?

Is it going into an AI assistant, a wallet, a website, a terminal or some other system that will act on it?

Those questions matter.

The Tags block deserves extra attention

Tags characters are unusual because their purpose is to represent information while remaining invisible in normal text rendering.

If a stranger sends you a message containing an unexpected sequence of them, that's worth investigating.

A scanner can reveal that the characters exist and, where appropriate, decode the text they represent.

But even then, detection doesn't tell you the sender's intention.

It tells you what is in the text.

That's a much more useful and defensible answer.

What a clean scan does — and doesn't — tell you

This is another place where security tools need to be honest.

A scanner detects characters.

It does not read people's minds.

If the scanner finds invisible characters, it can tell you what they are.

It cannot tell you who inserted them.

It cannot prove why they were inserted.

And if it finds nothing, that doesn't mean the message itself is trustworthy.

A completely normal-looking sentence can still contain a lie, a malicious link or a dangerous instruction.

Likewise, a message containing an invisible character can be completely harmless.

There are also limits to automated homoglyph detection. A scanner can check known look-alike characters and known character sets, but no single check should be treated as a guarantee that every possible visual deception has been found.

The result tells you what was detected.

You still have to decide what the text means and whether you trust its source.

The simple habit worth building

You don't need to be scared of copying and pasting.

Just slow down when the text you're copying is about to make something happen.

An AI assistant.

A wallet.

A website.

A command line.

An account.

A financial transaction.

A piece of code.

If you didn't type the text yourself, you don't necessarily know everything that's inside it.

And you don't have to guess.

Check the characters before you let them act.

It takes seconds.

And in many cases, the check is free.

This article is for educational purposes only. It explains how invisible Unicode characters, text-direction controls and look-alike characters can affect digital text. The example on this page contains deliberately inserted invisible characters so you can inspect the mechanism yourself. The hidden text is harmless and exists only for demonstration purposes.