
Zero-Width Steganography
Hide secret messages inside innocent-looking text using invisible zero-width Unicode characters. The hidden data is completely invisible to the naked eye.

How it works
This tool uses invisible Unicode characters to hide messages within ordinary text:
- 0 → U+200C (Zero-Width Non-Joiner)
- 1 → U+200B (Zero-Width Space)
- sep → U+FEFF (Zero-Width No-Break Space)
Each character in the secret message is converted to its binary representation, then each bit is replaced with an invisible zero-width character. In text mode, the payload is inserted between the first two visible characters. In emoji mode, the payload is embedded directly inside a single emoji — the emoji looks identical but carries the hidden data.
Why this attack is hard to detect
Zero-width steganography is particularly dangerous because the modified text is visually identical to normal text. There is zero visible difference between a clean message and one carrying a hidden payload.
- • Standard copy/paste preserves the invisible characters — the payload travels silently across platforms
- • Most content filters and moderation tools only scan visible text and completely miss zero-width payloads
- • A single emoji like 😈 can carry an entire hidden message while looking completely normal
- • Character count in most editors won't reveal the extra invisible characters — only hex inspection exposes them
This makes it a potential vector for data exfiltration, covert communication, watermarking text to track leaks, or bypassing content filters that rely solely on visible text analysis.
How to protect yourself
For developers
- • Strip zero-width characters (
U+200B,U+200C,U+200D,U+FEFF) from user input at the server level - • Compare
string.lengthvs visible character count — a mismatch indicates hidden characters - • Implement Content Security Policies that filter Unicode ranges commonly used for steganography
- • Log and flag inputs where invisible character count exceeds a reasonable threshold
For everyone
- • Use the Reveal mode above to inspect suspicious text — paste anything you want to check
- • Check the Hex View to see the raw invisible characters in any encoded output
- • Be cautious with emoji-only messages from untrusted sources — a single emoji can contain an entire hidden message
- • When sharing sensitive text, re-type it instead of copy-pasting to avoid carrying over hidden payloads
Related Tools
htpasswd Generator
Generate Apache .htpasswd entries for basic authentication with MD5, SHA-1, or plain text hashing.
Password Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any string for configs and databases.
WP Admin Generator
Generate SQL queries to create WordPress admin accounts instantly. Useful when locked out or need quick database-level access.