How hidden zero-width spaces, byte order marks, and non-breaking spaces break source code, databases, and authentication tokens.
## The Hidden Bug You Cannot See
Have you ever copied a code snippet or API token from Slack, Notion, or a blog post, only to encounter an unexpected syntax error?
```javascript
// Looks completely normal:
const apiKey = "sk_live_123456";
// SyntaxError: Invalid or unexpected token
```
In many cases, the culprit is an **invisible Unicode character** embedded invisibly between characters.
## Common Rogue Characters
- **U+200B (Zero-Width Space)**: Has zero width in UI fonts but consumes 3 bytes in UTF-8. Commonly inserted by rich text editors for line-wrapping.
- **U+FEFF (Byte Order Mark / Zero-Width No-Break Space)**: Invisible marker historically used at the start of UTF-16 files.
- **U+00A0 (Non-Breaking Space / )**: Visually indistinguishable from a regular space (U+0020), but will cause interpreters like Python and bash to throw syntax errors.
- **U+200E / U+200F (LTR / RTL Marks)**: Bidirectional override marks that can trick URL parsers and security firewalls.
## How to Clean & Sanitize Text
Before storing user inputs in SQL databases or compiling code, pass suspicious strings through our [Invisible Character Detector & Cleaner](../tools/text/invisible-character-detector-cleaner) to identify code points and strip them instantly.
