Hide a Message in Text
Hide a secret message inside ordinary text with invisible zero-width characters, optionally encrypted with a passphrase, then reveal or remove it.
This is a trick, not security: many apps and sites strip zero-width characters, and anyone can detect them with a simple check. Use the passphrase if the content matters.
Hide a message
- Visible characters
- Invisible characters added
- Size in UTF-8
Show where the hidden characters are
Each ◆ stands for one invisible character. Copy the text from the box above, not from this view.
Reveal or remove a hidden message
Remove all invisible characters
How to hide a message
- Type the Cover text (what everyone sees): an ordinary sentence that will look exactly the same afterwards.
- Type the Secret message.
- Optionally, enter a Passphrase. The message is then encrypted with AES-256-GCM before it is hidden, so knowing the method is not enough to read it.
- Choose Where to put the hidden characters: After the first word (default), Spread between the words, At the very start or At the very end.
- Click Hide message, then copy the Text with the hidden message with the copy button. Open Show where the hidden characters are to see them as ◆ symbols.
How to reveal or remove a hidden message
- Paste the text into Text to check. The number of zero-width characters appears below the box.
- Click Reveal message. If the message is encrypted, enter the Passphrase (if the message is encrypted) and click again.
- To clean a text, click Remove hidden characters: you get the same text without the hidden data. Emoji such as 👨👩👧, which legitimately use invisible joiners, are left intact.
Everything happens in your browser; neither the text nor the passphrase is sent anywhere.
How it works
Unicode contains characters that take up no space on screen. This tool uses four of them as digits: ZERO WIDTH SPACE (U+200B) = 00, ZERO WIDTH NON-JOINER (U+200C) = 01, ZERO WIDTH JOINER (U+200D) = 10 and WORD JOINER (U+2060) = 11. Your message is converted to UTF-8 bytes, and each byte becomes four invisible characters. The block starts and ends with a ZERO WIDTH NO-BREAK SPACE (U+FEFF) and carries a one-byte header that says whether the content is plain text or encrypted.
So the hidden part grows quickly: a 20-letter message adds about 90 invisible characters, and encryption adds 49 bytes of header and authentication tag (about 200 more characters). In UTF-8 each of these characters takes 3 bytes, which matters for fields with a byte limit. Size in UTF-8 in the results shows the real size of the whole text.
With a passphrase, the tool uses the same format as the text encryption tool: PBKDF2-SHA-256 with 600,000 iterations derives the key, AES-256-GCM encrypts, and a wrong passphrase or a single altered character makes decryption fail instead of returning garbage.
Limits: a trick, not security
- Many platforms strip zero-width characters. Some messaging apps, social networks, form fields and word processors remove or normalise them. Test with the destination first: paste the result there, copy it back and click Reveal message.
- Partial copies break the message. If the reader copies only part of the text, the block is incomplete and the tool usually reports it as damaged.
- It is easy to detect. Any invisible-character checker, a hex editor or a simple count reveals that something is there. Hiding the existence of a message against a determined observer is not possible this way.
- Without a passphrase it is only obfuscation. Anyone who knows this common technique can decode it. Use a strong passphrase for anything sensitive, and share it through another channel.
To remove every kind of invisible character (no-break spaces, bidirectional controls, soft hyphens and more), use the Invisible Character Remover.
Frequently asked questions
Will the hidden message survive being sent by email or chat?
Sometimes. Plain-text email and many chat apps keep zero-width characters, but some services strip them, and some keyboards or editors change them. Always do a round-trip test.
Can other tools read messages hidden here?
Only tools that use the same encoding. There is no standard for zero-width steganography, so different tools are generally not compatible.
Does spreading the characters between words help?
It keeps long runs of invisible characters out of one place, which can survive some editors better and looks less suspicious in a character inspector. It doesn’t make the message harder to find for software.
Why does the tool find zero-width characters but no message?
The text contains invisible characters that were not written in this tool’s format: copied from a web page, inserted by an editor, or another tool’s watermark. The Invisible Character Remover can list them.
What happens if I hide a new message in a text that already has one?
The old hidden block is removed first, so the result contains only the new message.
Related tools
- Invisible Character Remover Find and remove invisible characters online. Detect zero-width spaces, non-breaking spaces, soft hyphens and bidi controls (Trojan Source) in any text.
- Text Encryption Tool Encrypt and decrypt text with a passphrase in your browser, using AES-256-GCM and PBKDF2 with 600,000 iterations. Nothing is uploaded. Honest limits explained.
- Hide Text in an Image Hide a secret text message in an image with LSB steganography, optionally encrypted with AES-256-GCM, and reveal it later. Runs locally, no upload.
- Text to Binary, Hex and ASCII Convert text to binary, hexadecimal, decimal or octal codes and back, with UTF-8 bytes or Unicode code points, custom separators and a character table.