Hidden Content Inspector

Zero-width characters are Unicode code points that occupy no visible space when rendered by text engines. Characters like Zero Width Space (U+200B), Zero Width Non-Joiner (U+200C), and Zero Width Joiner (U+200D) are invisible in most text editors and browsers. By encoding binary data as sequences of different zero-width characters, hidden messages can be embedded within normal-looking text. For example, 0 bits could be encoded as ZWSP and 1 bits as ZWNJ, allowing arbitrary data to be hidden in seemingly innocuous text. This technique is used for document fingerprinting, covert communication, and DRM tracing.

Yes, any valid Base64 string can be decoded using the browser atob() function. The tool scans for long Base64-like patterns (40+ characters) and attempts to decode them, verifying the output contains readable text before reporting high confidence. If the decoded output contains URLs, API endpoints, JSON, source code, or recognizable text patterns, the confidence is rated as Very High (5). Invalid Base64 or strings that decode to binary/garbled data are still reported but with lower confidence.

Confidence scores range from 1 to 5. Score 5 (Very High) is assigned when Base64 or hex decoded content produces readable text, or when trailing data with significant content is found after EOF markers. Score 4 (High) is for large suspicious comments or multiple zero-width character occurrences. Score 3 (Medium) is for whitespace steganography patterns or isolated invisible characters. Score 2 (Low) is for metadata markers or single instances of invisible characters. Score 1 (Uncertain) is for weak or ambiguous indicators.

The risk level (Low, Medium, High, Critical) is calculated based on the number, type, and confidence of all detections. Critical is assigned when there are 5+ high-confidence indicators or 15+ total indicators, suggesting likely malicious hidden content. High is assigned for 2+ high-confidence indicators or 8+ total indicators, suggesting significant hidden content. Medium indicates moderate hidden content that warrants investigation. Low indicates minimal hidden content, which may be benign metadata or incidental findings.

No. The Hidden Content Inspector analyzes text-based content only. It can detect hidden content in text files, source code, documents, configuration files, and similar text formats. For image steganography (LSB, DCT), audio steganography (spectrograms, phase encoding), or video steganography, you would need specialized tools designed for those media formats. This tool focuses on the text-based hidden content techniques most commonly found in code, documents, and data files.

Absolutely. The Hidden Content Inspector runs entirely in your browser. Your content, all detected indicators, decoded payloads, analysis results, and annotated output are never uploaded to any server, stored in any database, or transmitted over the network. All processing happens locally on your device with no API calls or data collection. This makes it completely safe for scanning sensitive documents, proprietary source code, or confidential data.

Trailing data after EOF markers is a common technique used by malware and data exfiltration tools. After a file logically ends (indicated by characters like ^C, ^D, ^D, or FILE SEPARATOR), additional data can be appended without affecting normal file operations. Many parsers and applications stop reading at the EOF marker, ignoring the trailing data. This allows attackers to hide payloads, C2 URLs, or exfiltrated data in plain sight. Security scanners and forensic tools specifically check for data after EOF markers as a key indicator of tampering.

Yes — 100% free with no signup, no account, and no usage limits. Scan as much content as you need, as many times as you want. There are no premium tiers, hidden charges, or rate limits. The tool runs entirely in your browser — your content never leaves your device.