Free, browser-based utilities for everyday developer workflows

Zero-Width Phishing Detector

Security Tools

Detect zero-width and invisible Unicode characters in pasted text, URLs, and sender lines locally in your browser, with code-point evidence.

  • Paste a suspicious link, sender, domain, raw header, or copied message text.
  • The tool automatically detects the input type and runs local checks.
  • No URL is fetched, opened, or rendered as a clickable result.
Runs locally

Inspect suspicious content

Runs in your browser. Your pasted content is not sent to a server.

Not sure? Just paste it above. We will detect it automatically.

Safe example gallery

How to use the Zero-Width Phishing Detector

Paste copied text, a sender line, or a suspicious URL to see whether invisible characters are changing what you think you pasted. It is useful for catching hidden text before you trust it.

What it does

  • Flags zero-width and invisible character evidence in copied text.
  • Shows normalization changes and code-point details.
  • Helps spot hidden edits inside URLs, names, and messages.

When to use it

  • A copied value looks correct but behaves strangely when pasted.
  • You suspect hidden spacing or invisible separators in a link.
  • You need to verify whether a sender line contains hidden Unicode.

How to use it

  1. Paste the suspicious text into the input.
  2. Optionally enter a trusted domain for comparison.
  3. Click Analyze locally and review the Unicode evidence.
  4. Expand normalization details if the pasted value changes form.

FAQ

  • Does this tool fetch suspicious links? No. All analysis runs locally in your browser and the tool does not open or fetch pasted URLs.
  • Can I paste raw email headers? Yes. Paste raw headers and the inspector checks From, Reply-To, Return-Path, Authentication-Results, and related spoofing indicators locally.
  • Does the inspector send my input to a server? No. Everything stays in your browser. Nothing you paste is sent to a server or third-party API.
  • What kinds of spoofing does it look for? It looks for invisible characters, bidi controls, mixed scripts, confusable domains, Punycode hostnames, misleading subdomains, credential-in-URL tricks, and sender mismatches.
  • Can it compare a suspicious value against a trusted domain? Yes. You can enter an optional trusted domain so the inspector can compare the pasted content against a known-good brand or host locally.

Related guides