securitysteganographyunicodeprivacy

Zero-Width Steganography

Hide secret messages inside innocent-looking text using invisible zero-width Unicode characters. The hidden data is completely invisible to the naked eye.

Free tool
Runs in browser
No data stored
Zero-Width Steganography

How it works

This tool uses invisible Unicode characters to hide messages within ordinary text:

  • 0 → U+200C (Zero-Width Non-Joiner)
  • 1 → U+200B (Zero-Width Space)
  • sep → U+FEFF (Zero-Width No-Break Space)

Each character in the secret message is converted to its binary representation, then each bit is replaced with an invisible zero-width character. In text mode, the payload is inserted between the first two visible characters. In emoji mode, the payload is embedded directly inside a single emoji — the emoji looks identical but carries the hidden data.

Why this attack is hard to detect

Zero-width steganography is particularly dangerous because the modified text is visually identical to normal text. There is zero visible difference between a clean message and one carrying a hidden payload.

  • Standard copy/paste preserves the invisible characters — the payload travels silently across platforms
  • Most content filters and moderation tools only scan visible text and completely miss zero-width payloads
  • A single emoji like 😈 can carry an entire hidden message while looking completely normal
  • Character count in most editors won't reveal the extra invisible characters — only hex inspection exposes them

This makes it a potential vector for data exfiltration, covert communication, watermarking text to track leaks, or bypassing content filters that rely solely on visible text analysis.

How to protect yourself

For developers

  • Strip zero-width characters (U+200B, U+200C, U+200D, U+FEFF) from user input at the server level
  • Compare string.length vs visible character count — a mismatch indicates hidden characters
  • Implement Content Security Policies that filter Unicode ranges commonly used for steganography
  • Log and flag inputs where invisible character count exceeds a reasonable threshold

For everyone

  • Use the Reveal mode above to inspect suspicious text — paste anything you want to check
  • Check the Hex View to see the raw invisible characters in any encoded output
  • Be cautious with emoji-only messages from untrusted sources — a single emoji can contain an entire hidden message
  • When sharing sensitive text, re-type it instead of copy-pasting to avoid carrying over hidden payloads

Related Tools