Zero-Width Character

Every letter a computer stores is, behind the scenes, a number. These numbers are fixed in a worldwide table so that an A appears as an A on every device. This table also contains characters that have no width at all when displayed. So they are present in the text, but nothing can be seen on screen in their place. This is exactly what zero-width characters are, characters without width, so to speak. A word can show five visible letters and still consist of eight stored characters.

Why invisible characters are a security topic

Humans judge text by how it looks. Programs judge it by what numbers are contained within it. Zero-width characters drive these two perspectives apart. Anyone who uses them skillfully can inform two readers of the same text differently: the human and the machine.

Spam senders exploit exactly this. A filter searches for a forbidden word, but right in the middle of the word sits an invisible character. For the filter, the character sequence no longer matches, while to the eye it looks completely normal. The same idea works with password fields, search functions, or program code.

Since AI chatbots have become widespread, a new risk has emerged. Instructions can be embedded in invisible characters within a webpage or document. The human sees nothing of this, but the language model reads the command along with everything else. Such hidden instructions are called prompt injection, meaning the smuggling of foreign commands into an AI request.

How a character without width comes about in the first place

The Unicode character table contains over a hundred thousand characters. Not all of them are letters. Some are pure control characters that communicate something to the text program rather than being visible themselves. The best-known example is the Zero Width Space, technically U+200B. It acts like a space that marks a line-break point but occupies nothing itself.

Others have genuine tasks within writing systems. The Zero Width Joiner links two characters into one combined image. This is how composite emojis arise: a person emoji, a joiner, and a firefighter’s helmet together form a firefighter emoji. In Arabic or Indic scripts, such characters control whether letters merge or remain separate.

Because each of these characters has its own number, information can be encoded with them. One defines: one character type means zero, another means one. This makes it possible to weave an entire message in zeros and ones into an innocuous sentence. This technique is called steganography, meaning the hiding of a message within an inconspicuous carrier.

Where they turn up in texts, tools, and headlines

In everyday life, most people encounter them without noticing. When an emoji consists of several parts, joiners are at play. When a long web address wraps neatly within body text, an invisible character has often marked the break point. Both are entirely harmless and intentional.

They become noticeable when text is copied. Anyone who pastes program code from a webpage into their editor sometimes picks up invisible characters along with it. The code then looks correct but won’t run, and the error message seems illogical. Many editors now highlight such characters in color, precisely for this reason.

In the news, zero-width characters mostly come up in connection with AI security. Researchers regularly demonstrate how assistant systems can be manipulated via invisible text in documents. Conversely, there is discussion of using them to invisibly mark AI-generated text so it can later be identified. A common misconception is that such characters are hard to find: anyone who inspects the raw text sees them immediately, since their numbers are clearly present in the data stream.