All of this happens in the page with JavaScript. It makes no network requests. Open your dev tools and check the network tab if you want to see for yourself.
What goes wrong
Hidden Unicode can make two strings look identical while comparing differently, break field names in data imports, and alter how source code is displayed. Invisibles shows the character, category, and code point so you can decide what to change.
What it looks for
- Zero-width characters
- Zero-width spaces and joiners, the word joiner, the byte-order mark. Completely invisible, and the ones that quietly break search and passwords.
- Spaces that aren't spaces
- Non-breaking space, the narrow no-break space, ideographic and thin spaces. They look like a normal space and aren't one.
- Direction controls
- Right-to-left overrides and isolates. These can reorder text on screen so it reads differently from what's stored, which is the basis of the Trojan Source trick.
- Tag characters and variation selectors
- Invisible characters that still change the stored Unicode sequence.
Look-alike spaces are replaced with normal spaces so words don't run together. Other flagged characters are removed. The optional checkbox also converts curly quotes, em dashes, and ellipses to plain ASCII when a target system needs it.
It doesn't upload anything
The scanner and cleaner run entirely in this page. There is no server-side text processing, analytics, or account. You can download the source and run it offline.
Source on GitHub if you'd rather run it yourself, or grab the browser extension so it's a click away from any tab.