Control character filter
What the control character filter does
A control character is a codepoint that does not represent a printable letter or symbol at all. It carries an instruction instead: join two characters, force text to flow right to left, mark a boundary that a line break shouldn't cross. None of that renders as a glyph, so none of it is visible, while all of it is still sitting in the text as real bytes.
This tool scans pasted text for that whole category and removes it, leaving every visible character, every letter, digit and punctuation mark, exactly where it was. It runs in your browser: nothing is uploaded, there's no account, and no limit on how much you filter.
How it works
How to filter control characters from text in three steps
There's nothing to see beforehand, since these characters are non-printing by definition.
- Step 1
- Paste text you suspect carries hidden formatting characters.
- Step 2
- Press Filter. It runs instantly, on your own device.
- Step 3
- Copy the result; every visible character is untouched.
Non-printing, defined
What 'non-printing' actually means
Every character in Unicode belongs to a category. Letters, digits and punctuation belong to categories that a font renders as a shape on screen. A separate category, generally labelled Format, contains characters with no shape at all: they exist purely to modify how neighbouring characters are treated, not to be seen themselves.
That's the category this tool targets: zero-width joiners and non-joiners, word joiners, soft hyphens and, most consequentially, the directional formatting characters that control whether text flows left to right or right to left.
The sharper risk
Directional override characters, and why they matter more
U+202D and U+202E, the left-to-right and right-to-left override characters, don't just fail to render. They actively change the display order of every character that follows them, until a matching pop character or the end of the text cancels the effect.
That's a real security concern, not just a formatting one: a right-to-left override placed inside a file name can make 'invoice_gpj.exe' display as 'invoice_exe.jpg', reversing the visible order of the extension while the actual file stays exactly what it was. This tool removes those override characters along with the rest of the format category.
Why it survives
Why these characters survive a copy and paste
A control character has no shape, so there's nothing on screen to notice or accidentally delete while editing. Copy and paste operations move the underlying text exactly as it exists, invisible characters included, and most editors give no visual indication that anything beyond the visible letters was carried along.
That's the whole reason this category of bug is hard to catch by eye: the file, the field, the message all look completely normal, right up until something downstream reads the bytes rather than the rendered page.
Why it matters
What control characters actually break
Log files and monitoring tools can render control characters as stray glyphs or line-noise, or worse, interpret one as a terminal escape sequence and change how subsequent output displays. A filename or URL carrying a directional override can display differently from what it actually is, which is a real vector for disguising a malicious link or attachment.
In code, a control character sitting inside a string literal or an identifier produces an error with a cause that's invisible in the editor. In structured data, one embedded in a field can break strict parsing outright.
Who uses it
Who uses a control character filter, and when
Security-conscious teams reviewing file names, URLs or pasted text for directional-override tricks before opening or forwarding anything suspicious. Developers cleaning text pulled from an external source before it reaches a log pipeline, a terminal or a parser that could misread a stray control character as an instruction.
Anyone maintaining a system that stores or displays user-submitted text uses it to strip formatting characters that could otherwise scramble how that text displays to someone else.