Invisible Unicode & hidden-instruction detector
Paste any text — an AI tool description, README, system prompt or pasted LLM output — and spot zero-width characters, bidi overrides and Unicode tag characters used to hide instructions. Runs entirely in your browser; nothing is uploaded.
100% client-side — your text never leaves this page.
About invisible Unicode attacks
What are invisible Unicode characters and why do they matter for AI?
Characters like zero-width spaces (U+200B), bidirectional overrides, and Unicode tag characters (U+E0000–U+E007F) render as nothing to a human but are read by machines. Attackers smuggle hidden instructions into AI tool descriptions, READMEs and prompts with them — a form of prompt-injection / tool poisoning a human reviewer can't see. This tool surfaces them.
Does my text get uploaded anywhere?
No. The scan runs entirely in your browser — nothing is sent to a server. You can paste sensitive prompts safely.
What does it detect?
Zero-width and invisible characters, bidirectional (RTL/LTR) override controls, Unicode tag characters, variation selectors, invisible fillers and unusual whitespace — with the exact code point and position of each, plus a one-click clean that strips them.
How is this related to MCP and agent security?
Invisible-Unicode smuggling is one of the injection vectors PALANIT's scanner checks for in MCP server tool definitions. If you run MCP servers or agent tools, scan their configs with the free MCP scanner too.
Run MCP servers or agent tools? Scan your MCP config for the same hidden-instruction patterns, or check your site for php2shell.