Unicode's vast character repertoire includes symbols with no visible glyph at all: zero-width space (U+200B), zero-width joiner, and word joiner among them. These exist for legitimate typesetting reasons in some scripts, but they're also a convenient way to break up a string that a naive text filter is scanning for — splitting 'paypal.com' with a zero-width space between characters defeats a substring match while rendering visually identical to the original in most fonts.
Bidirectional control characters are a sharper tool. Right-to-left override (U+202E) and its relatives were designed to let left-to-right text correctly embed right-to-left scripts like Arabic or Hebrew, but they can be repurposed to visually reverse part of a string's display order without changing its underlying bytes — a technique used to disguise malicious file extensions (making 'evilexe.txt' display as 'txt.exegilve' or similar) and to construct misleading filenames that pass a human glance but not a byte-level check.
Confusable homoglyphs are visually near-identical characters from different Unicode blocks — Cyrillic 'а' (U+0430) versus Latin 'a' (U+0061), or Greek 'Α' versus Latin 'A'. Registering a domain using a Cyrillic 'а' where a victim expects a Latin one produces a URL that looks correct in most fonts and passes a casual glance, but resolves to an entirely different server. This is the mechanism behind most homograph phishing attacks and is exactly why Unicode maintains an official confusables table for browsers and registrars to check against.
This inspector scans every character in the input against tables of zero-width, invisible, and bidi-control code points, cross-references letters against a confusables table for mixed-script substitutions, and — because this matters most for exactly the strings that look totally normal — it runs automatically on every input rather than requiring you to select it as a mode.
Edge cases worth knowing
- A domain name mixing Latin and Cyrillic characters
- аpple.com (with a Cyrillic 'а' as the first character) renders identically to apple.com in nearly every font but is a different domain entirely. This inspector flags mixed-script strings and calls out exactly which characters are the non-Latin substitutes.
- Legitimate use of bidi controls for actual right-to-left text
- A string containing Arabic or Hebrew text embedded in an English sentence may legitimately use directional formatting characters. This inspector flags all bidi controls as worth reviewing rather than assuming malicious intent — context determines whether the usage is a display fix or an attack.
- A zero-width character used as an invisible watermark
- Some tools intentionally embed zero-width characters as a steganographic tracking mechanism (to identify who leaked a document, for instance). This inspector surfaces the exact count and position of every zero-width character regardless of whether the use case is adversarial or intentional tracking.
Common mistakes
- Validating a username or domain purely by its visual rendering instead of checking for zero-width and confusable characters at the byte level.
- Trusting a copy-pasted URL or filename that 'looks right' without inspecting it for embedded bidi overrides that could be flipping displayed character order.
- Building a profanity or substring filter that can be trivially defeated by inserting zero-width characters between the filtered word's letters.
- Allowing mixed-script usernames or domains without normalizing or flagging scripts that don't match the primary expected alphabet.