Covered marks
Invisible Unicode Mark Guide
Some Unicode characters carry no visible width and no sound — yet they can watermark a document, split a keyword, or reverse what a filename appears to say. These guides cover the invisible marks the AIPwn text inspector detects, what legitimate uses exist, and how each one is abused. Checking runs locally in your browser; nothing is uploaded.
Zero Width Space (U+200B)
U+200B ZERO WIDTH SPACE is an invisible character that occupies no horizontal space. It belongs to no alphabet: typography engines insert it to mark line-break opportunities, and steganographic tools insert it to encode hidden information inside ordinary-looking text. When you copy text containing U+200B, the invisible characters travel with it.
How it is abused: Invisible watermarking: leak-tracing tools sprinkle U+200B sequences through a document so each recipient's copy carries a unique hidden fingerprint.
Legitimate uses: Some typography engines place U+200B at line-break opportunities, and some editors leave it behind after formatting. Presence alone is not proof of tampering — read the context before judging.
Zero Width Non-Joiner (U+200C)
U+200C ZERO WIDTH NON-JOINER is an invisible character that prevents two letters from connecting. It has real linguistic jobs in cursive scripts, and it is invisible in every context — which makes it just as useful for hiding information or faking lookalike names.
How it is abused: Lookalike account names: inserting U+200C into a username or brand name produces something that renders identically but is a different string.
Legitimate uses: U+200C is a required letter-form control in Persian, Urdu, Kurdish and several Indic orthographies, and it appears in some text-shaping edge cases. If the text is from those languages, finding it is expected — inspect the context instead of assuming tampering.
Zero Width Joiner (U+200D)
U+200D ZERO WIDTH JOINER is an invisible character that joins adjacent characters into one shaped unit. It is the backbone of composed emoji (family, profession, and skin-tone sequences) and a letter-form control in complex scripts — and because it is invisible, it can also hide data or split keywords without a trace.
How it is abused: Invisible keyword splitting: inserting U+200D inside a word keeps it readable but breaks exact-match search, filters, and comparisons.
Legitimate uses: U+200D is required for most composed emoji and for correct letter shaping in scripts such as Hindi, Arabic-styled orthographies, and other complex writing systems. Finding it there is normal — judge by context, not by presence alone.
Right-to-Left Override (U+202E)
U+202E RIGHT-TO-LEFT OVERRIDE is a bidirectional control that flips the rendering direction of all following text until the paragraph ends or the override is cancelled. The characters themselves do not change — only what you see does. That gap between logical order and visible order is what attackers exploit.
How it is abused: Filename spoofing: an executable can display as `photo.jpg` while its real name ends in an executable extension — the RLO reverses what you see, not what the operating system runs.
Legitimate uses: RLO exists to embed right-to-left quotations or names inside left-to-right text without relying on the full bidirectional algorithm. It is uncommon; treat any occurrence in filenames, code, or URLs as worth reviewing.