Every invisible and look-alike character, in one table
Invisible Unicode characters are code points with no visible glyph that still affect text processing — they change how text breaks, joins, flows, and compares, while showing nothing on screen. The last two rows are a different problem worth knowing about: look-alikes, which do have a glyph but are not the character you think they are. This reference covers the ranges that matter in practice, from the everyday zero-width space (U+200B) to the security-relevant tag characters (U+E0000–U+E007F). Every entry is written as a code point, never as the raw character, so this page cannot contaminate your clipboard — and the last column says exactly what our cleaner does with each one, including the ones it deliberately leaves alone.
| Code point | Name | Category | Why it matters | What our cleaner does |
|---|---|---|---|---|
| U+200B | Zero Width Space (ZWSP) | Zero-width | Invisibly glues words together; breaks search, spellcheck, and exact string matching. | Removed |
| U+200C | Zero Width Non-Joiner (ZWNJ) | Zero-width | Required inside Persian and many Indic words; pure baggage in English text. | Removed |
| U+200D | Zero Width Joiner (ZWJ) | Zero-width | Builds multi-person emoji; also a known hidden-data channel in plain text. | Removed (kept inside emoji) |
| U+2060 | Word Joiner | Zero-width | Zero-width no-break glue; a frequent stowaway in copied text. | Removed |
| U+FEFF | Byte Order Mark (BOM / ZWNBSP) | Zero-width | File-encoding marker; becomes a ghost character that breaks JSON, CSV, and scripts. | Removed |
| U+00AD | Soft Hyphen | Format | Invisible hyphenation hint from PDFs and justified layouts; pollutes extracted text. | Removed |
| U+00A0 | No-Break Space (NBSP) | Space | Looks like a space but is not one to parsers; the HTML entity. | Converted to U+0020 |
| U+202F | Narrow No-Break Space (NNBSP) | Space | Reported in o3/o4-mini output in April 2025; standard in French number formatting. | Converted to U+0020 |
| U+2009 | Thin Space | Space | Typesetting space that defeats exact-match search and deduplication. | Converted to U+0020 |
| U+200A | Hair Space | Space | The thinnest space; visually indistinguishable from a normal space. | Converted to U+0020 |
| U+2000–U+2008 | En Quad through Punctuation Space | Space | Nine fixed-width typesetting spaces; all read as ordinary spaces on screen. | Converted to U+0020 |
| U+205F | Medium Mathematical Space | Space | Spacing around math operators; strays into copied formulas and equations. | Converted to U+0020 |
| U+3000 | Ideographic Space | Space | Full-width CJK space; misaligns mixed English-CJK text. | Converted to U+0020 |
| U+180E | Mongolian Vowel Separator | Format | Reclassified from space to invisible format character; a notorious edge case. | Removed |
| U+200E / U+200F | Left-to-Right / Right-to-Left Mark | BiDi | Flip text direction; cause cursor jumps and misplaced punctuation. | Removed |
| U+061C | Arabic Letter Mark | BiDi | Direction control for Arabic-script digits; invisible everywhere else. | Removed |
| U+202A–U+202E | BiDi Embeddings and Overrides | BiDi | Can visually reorder code and URLs; the 'Trojan Source' attack vector. | Removed |
| U+2066–U+2069 | BiDi Isolates | BiDi | Modern directional isolates; same reordering risks, still invisible. | Removed |
| U+2028 / U+2029 | Line / Paragraph Separator | Format | Invisible line breaks that crash JavaScript and break JSON parsers. | Converted to a newline |
| U+0085 | Next Line (NEL) | Format | A C1 control that some systems treat as a line break and others ignore entirely. | Converted to a newline |
| U+E0000–U+E007F | Tag Characters | Security | An invisible copy of ASCII; the 'ASCII smuggling' prompt-injection channel. | Removed (kept in flag emoji) |
| U+FE00–U+FE0F | Variation Selectors | Format | Select glyph variants (text vs emoji style); each can also hide data. | AI Clean and Plain ASCII only |
| U+E0100–U+E01EF | Variation Selectors Supplement | Security | 240 more invisible selectors; enough to encode arbitrary hidden bytes. | AI Clean and Plain ASCII only |
| U+034F | Combining Grapheme Joiner | Format | Invisible combining character that defeats naive text filters. | Removed |
| U+FFFC | Object Replacement Character | Format | Placeholder left behind where an embedded image or object used to sit. | Removed |
| U+FFF9–U+FFFB | Interlinear Annotation Anchor / Separator / Terminator | Format | Ruby-annotation controls that survive copy-paste out of typeset East Asian text. | Removed |
| U+115F / U+1160 | Hangul Choseong / Jungseong Filler | Format | Zero-width Hangul placeholders long used to fake blank usernames and messages. | Removed |
| U+3164 / U+FFA0 | Hangul Filler / Halfwidth Hangul Filler | Format | Render as blank space in most fonts; a classic invisible-username trick. | Removed |
| U+17B4 / U+17B5 | Khmer Vowel Inherent Aq / Aa | Format | Invisible inherent vowels that Unicode advises against using in plain text. | Removed |
| U+2010 | Hyphen | Look-alike | Renders like the ASCII hyphen-minus but fails exact matching. | Not detected or changed (Plain ASCII deletes it) |
| U+2011 | Non-Breaking Hyphen | Look-alike | A hyphen that forbids a line break; identical on screen to U+2010. | NFKC folds it to U+2010, still not ASCII (Plain ASCII deletes it) |
| U+0430 | Cyrillic Small Letter A (homoglyph) | Look-alike | Pixel-identical to Latin 'a'; the classic character substitution flagged by Turnitin. | Not detected or changed (Plain ASCII deletes it) |
To strip the rows marked "Removed" or "Converted" from your own text, use the cleaner at the top of this page or the dedicated invisible character remover. To check text without changing it, see the AI watermark checker. The single most common family in the table, U+200B and its zero-width neighbours, gets a closer look on the zero-width space remover.
Which invisible characters appear in AI-generated text?
The best-documented case is the narrow no-break space (U+202F): in April 2025, days after OpenAI launched o3 and o4-mini, the academia startup Rumi reported those models embedding U+202F where normal spaces belong in longer outputs. OpenAI said the characters were not a watermark but "a quirk of large-scale reinforcement learning," and they vanished from output within days — the full story is on our ChatGPT watermark page.
Beyond that episode, most invisible characters in AI text arrive through the tooling around the model rather than the model itself: HTML rendering converts spacing to U+00A0, Word and Google Docs add smart typography and non-breaking spaces, and PDFs contribute soft hyphens (U+00AD). Zero-width spaces (U+200B) and word joiners (U+2060) also ride along when AI answers are copied from chat interfaces. Our guide to ChatGPT's hidden characters shows how to detect each one.
Which invisible characters are security risks?
Three groups: tag characters, variation selectors, and BiDi overrides. Tag characters (U+E0000–U+E007F) are a complete invisible copy of ASCII, which makes them a channel for "ASCII smuggling" — hiding instructions inside text that humans cannot see but language models happily read. Riley Goodside demonstrated the technique in January 2024, and security researcher Johann Rehberger chained it into a Microsoft 365 Copilot exploit that exfiltrated email content and MFA codes through invisible characters (disclosed January 2024, since fixed). In October 2025, FireTail retested major models: ChatGPT, Copilot, and Claude sanitized tag characters, while Gemini, Grok, and DeepSeek remained vulnerable — and Google declined to fix, classifying it as social engineering.
Variation selectors (U+FE00–U+FE0F plus the U+E0100–U+E01EF supplement) offer 256 invisible values — one hidden byte after any visible character. Paul Butler's February 2025 post "Smuggling arbitrary data through an emoji" showed the encoding trick, and Mindgard/Lancaster University researchers (arXiv:2504.11168, April 2025) used "emoji smuggling" to achieve up to 100% evasion of production LLM guardrails, including Azure Prompt Shield and Meta Prompt Guard. BiDi embeddings and overrides (U+202A–U+202E) round out the list: they can visually reorder source code and URLs, the "Trojan Source" class of attacks. That family, together with the U+200E and U+200F directional marks, is covered in full on how to remove BiDi control characters. A related but visible-not-hidden trick is the homoglyph attack, which swaps a letter for a lookalike from another script instead of hiding anything.
Which invisible characters are legitimate?
Many of them — in the right context. ZWNJ (U+200C) is required to spell Persian and many Indic-script words correctly. ZWJ (U+200D) is the glue inside multi-person and profession emoji. U+202F is correct French typography for number grouping and before certain punctuation. BiDi marks and isolates make mixed Arabic-English or Hebrew-English text render in the right order. None of these characters is malicious by nature; they become noise only when they travel into text that never needed them.
That is why blind stripping is the wrong approach, and why CleanPastedText cleans emoji-safely: zero width joiners and variation selectors that sit inside a real emoji sequence are preserved automatically and labeled "kept" in the report, while the same characters loose in ordinary prose are stripped. For Persian or Indic text that depends on U+200C, Advanced Controls has a dedicated "Joiners (ZWNJ/ZWJ)" switch, separate from the general invisible-characters toggle, so you can keep it off without disabling every other cleaning rule. Either way, the report names every character it found by code point — nothing happens silently. The how-it-works page documents exactly what each pass touches.