Text can carry characters that are not there to be read. Zero-width spaces threaded between words mark a copy so that whoever leaks it can be identified. Direction overrides reorder what is displayed without changing what is stored, which is how a line of code can read one way to a reviewer and another to the compiler. And a Cyrillic а in a domain name is the whole of a phishing attack. This shows them, says what each one is, reads what is written in them, and takes them out.
The same text with every hidden character shown in its place. Hover one to see what it is.
A watermark is worth reading before you delete it. Two schemes are in use, and both are just bits: one uses two zero-width characters as 0 and 1, the other uses the invisible tag block as a direct copy of ASCII. Both are decoded here, so if a document was marked with a name or a number you see the name or the number, rather than only learning that something was there.
Direction overrides are the dangerous ones. They change what is displayed without changing what is stored, so a reviewer and a compiler read different programs from the same file, and a filename can be made to end in .txt while actually ending in something else. Anything containing one is flagged red rather than amber.
Look-alikes are off by default, deliberately. Folding a Cyrillic а to an a changes a letter rather than removing a mark, and a word written in Russian or Greek is not a trick. Turn it on when you are checking an address or a command, where every character should be ASCII, and leave it off for ordinary prose.
Where they are matters as much as how many. A hundred zero-width characters spread evenly through a document is a watermark; three of them inside one name is a marker for that name. The text is shown with each one in its place so you can tell which it is before you clean anything.
Nothing leaves this tab. Pasting a leaked document into a website to find out whether it is watermarked would be a remarkable way to leak it again. The scan happens in your browser, and with the network off it works exactly the same.
Paste it here. A watermark of this kind is a run of zero-width characters spread through the text, usually between words or after particular names, and it shows up immediately as a count of invisible characters with a pattern to where they sit. If the mark carries a name or a number, it is read out as well.
Making the code read differently from how it runs. The characters reorder the display without changing the bytes, so a comment can appear to close where it does not, and a reviewer approves something other than what is compiled. It was published as the Trojan Source attack and it works in most editors.
Because one of the letters is not the letter it appears to be. A Cyrillic а and a Latin a are drawn identically in most fonts and are different characters, so they are different domains. Tick the look-alike box and anything that is not plain ASCII is folded, which makes the substitution obvious.
It goes nowhere. The whole check runs in your browser, the file is never uploaded, and nothing is stored. Turn the network off and the page behaves identically, which is the simplest way to check that rather than believe it.
Removing invisible characters and direction overrides is safe for ordinary text. It is not always safe for text in Arabic, Hebrew or an Indic script, where joiners and marks do real work, so read the result before you use it. Folding look-alikes is the one that changes meaning, which is why it is off unless you ask.