Unicode Steganography Extractor
Extract hidden messages from text containing invisible Unicode characters or homoglyph substitutions. Auto-detect mode scans all methods.
Enter Stego Text to Decode
Paste the text that may contain hidden Unicode steganography
Try the demo instantly
No upload needed — loads a sample file
How to Extract Hidden Unicode Data (5 steps)
- Paste the stego text that may contain hidden Unicode data.
- Choose a mode: Auto-detect (recommended) or select a specific method.
- Enter the password if the payload was encrypted.
- Click 'Extract Hidden Data' — the message appears below.
- Copy the extracted message or download as file.
Unicode Decoding Methods
| Method | Technique | Detection | Best For |
|---|---|---|---|
| Auto-detect | Scans for all Unicode hiding methods | Best for unknown encoding | CTF challenges, quick analysis |
| Zero-Width Binary | Extracts from ZWSP/ZWNJ bit pairs | Most common method | When encoder used ZW-Binary |
| Zero-Width V2 | Extracts from 8-char ZW set | Compact ZW variant | When encoder used ZW-V2 |
| Homoglyph | Detects Cyrillic substitutions | Uses Cyrillic look-alikes instead of invisible characters | When encoder used Homoglyph |
| Variation Selector | Reads U+FE00-U+FE0F after emoji | Four bits per selector | When encoder used Variation Selector |
What the Extractor Reads
Paste text, or load a .txt file. The Extractor reads data written by this site's Hider with one of four methods: Zero-Width Binary (U+200B and U+200C), Zero-Width V2 (eight invisible characters), Homoglyph (Cyrillic look-alikes of Latin letters) or Variation Selector (U+FE00 to U+FE0F). It expects the Hider's own format, a 32-bit header holding the length and an encrypted flag, followed by the data. Text hidden by other tools usually uses a different layout and will not decode.
Auto-Detect first counts the characters of each kind, then tries the method the count suggests first (V2-only characters, then 8 or more Binary characters, 8 or more look-alikes, 2 or more selectors), then the remaining methods in a fixed order: Zero-Width Binary, Zero-Width V2, Homoglyph, Variation Selector. The count only changes which method is tried first; the other three are always tried afterwards, which is why a small Homoglyph message the scan does not suggest is still found. It stops at the first method that gives a valid message or a valid header of an encrypted message. If none does it reports that nothing was found.
The most basic mode uses Auto-Detect only. The more detailed modes show the scan counts and let you pick a method.
The Scan and the Suspicion Score
The scan counts four things in the whole text: characters from the Zero-Width Binary pair, all eight Zero-Width V2 characters, Cyrillic look-alikes, and selectors from U+FE00 to U+FE0F. The suspicion score adds 2 per Zero-Width Binary character (at most 40), 3 per V2-only character (at most 20), 2 per look-alike (at most 25) and 5 per selector (at most 15), up to 100.
It is a weighted character-count heuristic. It does not measure statistical randomness, estimate the probability that data is hidden, or establish that a message exists. Ordinary Persian text with a zero-width non-joiner scores above zero; Russian text is full of the Cyrillic letters that look like Latin ones; a line of hearts carries selectors. A score of zero does not prove the text is clean, because a copy that passed through an app may have lost the characters.
Passwords, Reed-Solomon and Damaged Text
The header says whether the message is encrypted. If it is and you gave no password, the Extractor asks for one; if the password does not open it, it says so. An incorrect password and damaged text cannot be told apart, because AES-GCM only reports that the check failed.
There are two different headers. The 4-byte message header (the encrypted flag and the length) is read first and is never protected by Reed-Solomon. If the message was written with Reed-Solomon, the data after it starts with a separate 16-byte Reed-Solomon wrapper header, so the Extractor repairs it without a setting. Reed-Solomon protects the wrapped data blocks, not the 4-byte message header or its own wrapper header. The result reports the number of bytes repaired, or the number of blocks that were beyond repair: their bytes are returned as found and may be wrong, so any text, file signature or flag match shown for such a result is unverified.
The Scan on Cover A With the Message "Hi"
Cover A is the sentence "The quick brown fox jumps over the lazy dog near a calm river today. " repeated 20 times (1,380 characters; cover B adds 100 emoji for Variation Selector). "Hi" was hidden with each method (seed 7) and then scanned.
| Text | Binary pair | All 8 ZW | Look-alikes | Selectors | Suspicion | Likely method | Auto-Detect result |
|---|---|---|---|---|---|---|---|
| Cover A, nothing hidden | 0 | 0 | 0 | 0 | 0 | none | nothing found |
| Zero-Width Binary | 48 | 48 | 0 | 0 | 40 | Zero-Width Binary | Hi |
| Zero-Width V2 | 12 | 16 | 0 | 0 | 36 | Zero-Width V2 | Hi |
| Homoglyph | 0 | 0 | 7 | 0 | 14 | none (needs 8) | Hi |
| Variation Selector (cover B) | 0 | 0 | 0 | 12 | 15 | Variation Selector | Hi |
How the Scan Picks a Likely Method
| Condition (checked in this order) | Likely method |
|---|---|
| Any of the six V2-only characters (U+200D, U+2060, U+2062, U+2063, U+2064, U+FEFF) | Zero-Width V2 |
| 8 or more U+200B / U+200C | Zero-Width Binary |
| 8 or more Cyrillic look-alikes | Homoglyph |
| 2 or more selectors | Variation Selector |
Result Fields
| Field | Values | Meaning |
|---|---|---|
| Method | The four methods | The method that produced the message |
| Type | text, encrypted, file, binary, noise, empty | What the recovered bytes look like: UTF-8 text; the layout of an encrypted payload; a known file type; other binary; random-looking; nothing |
| Encrypted | AES-256-GCM or None | AES-256-GCM only when the header said encrypted and your password opened it; None when the header said the data was not encrypted |
| ZW chars | A count | How many of the eight zero-width characters the whole pasted text contains, including any that are not part of the message |
| Homoglyphs | A count | How many Cyrillic look-alikes the whole text contains |
Examples
Input: Cover A with "Hi" hidden by Zero-Width Binary, Auto-Detect.
Result: The scan counts 48 characters from the Binary pair, score 40, likely method Zero-Width Binary. The result is Hi, and ZW chars shows 48.
Meaning: 48 is the 32-bit header plus 16 bits for the two letters.
Input: Cover A with "Hi" hidden by Zero-Width V2.
Result: 16 characters of the eight-character set, 12 of them U+200B or U+200C. Score 36 (12 × 2 + 4 × 3). Likely method Zero-Width V2.
Meaning: One V2 symbol is three bits, so 48 bits take 16 characters.
Input: Cover A with "Hi" hidden by Homoglyph.
Result: 7 look-alikes, score 14, no likely method (it needs 8), but Auto-Detect still tries Homoglyph and returns Hi.
Meaning: The scan is only a hint. The fixed fallback order finds a short message that the thresholds miss.
Input: The same message encrypted with the password right, opened with no password and with another password.
Result: Without a password: the Extractor asks for one. With another password: it reports that decryption did not pass. Neither shows the message.
Meaning: Both outcomes leave the message unread.
Input: Text that is only cover A, pasted unchanged.
Result: Nothing is found and every count is zero.
Meaning: A text that lost its hidden characters on the way looks the same, so this does not prove the original was clean.
Input: 10 copies of a Persian word that contains a zero-width non-joiner.
Result: The scan counts 10 characters, score 20 and likely method Zero-Width Binary, but nothing decodes.
Meaning: Real text can score above zero without carrying a message; a valid header is required.
Input: 12 lines of Russian text such as "Привет мир! ".
Result: The scan counts the Cyrillic letters that look like Latin ones and suggests Homoglyph; nothing decodes.
Meaning: Look-alike letters are real letters in Russian.
How the Unicode Extractor Works
1. Scan
The whole text is counted for the four kinds of character. The counts, the likely method and the suspicion score are shown in the detailed modes.
2. Read the slots of one method
Zero-Width Binary turns U+200B into 0 and U+200C into 1. V2 turns each of its eight characters into three bits. Homoglyph reads a Cyrillic look-alike as 1 and a Latin letter from the table as 0. Variation Selector reads each selector as a 4-bit value.
3. Read the header
The first 32 bits give the length and the encrypted flag. A length over 1,000,000, or more than the text holds, means this method found nothing.
4. Repair, then decrypt
Data that starts with the Reed-Solomon header is repaired. If the header said encrypted, the password is used; a failure is reported as such.
5. Describe the bytes
The bytes are checked for UTF-8 text, a known file type or random-looking data, and shown with a code point table for the first 500 characters of the pasted text.
What the results mean
| Result | What it means | What to do |
|---|---|---|
| Method, Type, Encrypted, ZW chars, Homoglyphs | The five fields in the table above. | ZW chars and Homoglyphs count the whole pasted text, not only the message. |
| Password asked for | The header says the message is encrypted and no password was given. | Enter the password and extract again. |
| Password rejected | A password was given and the authentication check failed. | Retype it; damaged text gives the same message. |
| Nothing found | No method gave a valid header. | Try each method by hand; check that you pasted the original text, not a copy that lost characters. |
| Reed-Solomon note | Bytes repaired, blocks beyond repair, or a header that needed no repair. | If blocks are beyond repair, use the original text. |
| Message text or binary payload | UTF-8 text is shown with a Copy button. Other data shows its type, an optional hex view of the first 256 bytes, and a download. | Check the type before opening a downloaded file. |
| Code point table | Up to the first 100 entries within the first 500 characters of your text with code points and names. Hidden characters appear as [hidden]; look-alikes in orange with the letter they imitate. | Use it to see where the hidden characters sit. |
| Look-alike list | Each Cyrillic look-alike among the first 500 characters, with its position and the Latin letter it stands for. | Compare with what you expect the text to say. |
| Watermark attribution | Matches an ID in the recovered message against a key file from a batch export. | Keep the key file private. |
Limitations
- Only text written by this site's Hider is decoded. Zero-width text from other tools may show up in the counts and the code point table but will not decode.
- Auto-Detect finds a message only if the text still holds every character of it. Removing, merging or changing even a few characters usually makes the length wrong, unless Reed-Solomon was used and the damage is within its limit.
- Unencrypted messages have no checksum. A valid header followed by enough data is accepted as a message.
- The scan and the suspicion score are counts of character kinds, not a detector, and the code point table covers only the first 500 characters.
- No platform, editor or sanitiser was tested. In our test, NFC and NFKC normalisation left all four methods readable.
Privacy
Your text is processed in your browser tab; the tool's own code does not upload it. Usage statistics may record which options were used and coarse facts such as sizes, never your text or message.
Which Tool Next?
- Unicode Steganography Hider — make a text to test the Extractor with.
- Invisible Text Extractor — zero-width text with character sets chosen per platform.
- HTML Steganography Extractor — hidden data in the source of an HTML file.
- Whitespace Steganography Extractor — spaces, tabs and line endings in text files.
Frequently Asked Questions
How do I know if text has hidden Unicode data?
Use Auto-detect mode, which tries all four methods. The tool also shows a suspicion score (a simple heuristic: it counts zero-width characters, Cyrillic look-alikes and variation selectors, so ordinary Persian, Russian or emoji text can score above zero). A clean score does not prove there is nothing hidden.
What if decoding returns garbage?
If the message was encrypted, the tool says so and asks for the password; an incorrect password and damaged data look the same. If nothing readable appears, pick each method by hand and check that the text was not edited, resaved or normalised after hiding.
Can I decode text from other tools?
This decoder uses its own wire format (a length header packed into the zero-width character stream), so it reliably decodes text produced by this site's own Unicode encoder. Text from other zero-width or homoglyph tools may use a different framing and might not decode even if individual hidden characters are detected by the scan.
Can I use this to find hidden Unicode characters in any text?
When a message is found, the result lists the invisible characters it recognises (zero-width characters, direction marks, soft hyphen and similar) and the Cyrillic look-alikes among the first 500 characters of the text, and tries to decode a message made by this site's Hider. It does not read messages written by other tools and it is not a full character inspector. The Invisible Text Extractor on this site covers the zero-width-only case.
Why does it show 'No hidden data found'?
The text may have passed through an app that removes invisible characters (we have not tested which ones do), or it may simply not contain hidden data. If you can, decode the original text rather than a pasted copy.
Related Tools
Unicode Steganography Hider
Hide secret messages in plain text using 4 Unicode methods: Zero-Width Binary, ZW-V2, Homoglyph, or Variation Selectors. Optional AES-256-GCM encryption. Processed in your browser, not uploaded.
Steganography Detector
Statistical steganalysis with three published tests — chi-square, RS analysis and Sample Pairs — fused into one score and checked against the real StegExpose on a small test set. Payload size estimate. Method fingerprint. WAV audio support. Processed in your browser, not uploaded.