Unicode Character Inspector — code points, bytes, entities & hidden glyphs

Real-world use cases

• Find the invisible character breaking a "duplicate" username check

  A signup form keeps rejecting "john" as taken, but the support team swears the account is free. Paste both strings here. One of them turns out to be `j o h n` where the second character is actually U+0435 CYRILLIC SMALL LETTER IE, not the Latin `o` — a homoglyph. The tool flags it red as a confusable, shows the code point, and you immediately know the original signup used a Cyrillic letter to squat the name. Without per-character code points you would have stared at two visually identical strings forever.

• Debug a JSON parser that chokes on a "clean" pasted config

  Your YAML/JSON loader throws "unexpected token" on line 1, but the file looks perfect in the editor. Paste the first line here. The summary flags a U+FEFF BYTE ORDER MARK sitting before the opening brace, or a U+00A0 NO-BREAK SPACE where you expected a regular space. Both are invisible in most editors. The tool highlights them as zero-width / invisible, gives you the `` JS escape so you can strip it with a precise `replace`, and the parse error disappears.

• Verify exactly how an emoji is encoded before storing it

  You are sizing a `VARCHAR` column and a single 👨‍👩‍👧‍👦 family emoji blows past your length limit. Paste it: the grapheme count says 1, the code-point count says 7, and the UTF-8 byte count says 25. The tool breaks the cluster into its parts — four person emoji joined by three U+200D ZERO WIDTH JOINER characters — so you understand why "one emoji" needs 25 bytes and can size the column (or your Twitter-style character budget) correctly.

• Build a precise HTML entity or JS escape for a tricky glyph

  You need to hardcode an em dash, a non-breaking space, or a mathematical symbol into source without pasting the raw character (which a teammate's editor might mangle). Type or paste the glyph, and each row gives you the named HTML entity (`—`), the numeric forms (`—` / `—`), and the JS escape (`—` or `\u{1F600}` for astral characters). One click copies the exact form your file needs.

• Audit user-supplied text for spoofing before it hits production

  You are reviewing a display name, a domain label, or a coupon code submitted by a user. Paste it and scan the right column: any zero-width space, right-to-left override (U+202E, the classic filename-spoofing trick), or mixed-script confusable gets a colored flag. You get a per-character verdict instead of trusting a string that "looks normal" — which is exactly how homograph phishing and RTL-override attacks slip through naive validation.

Common pitfalls

• A grapheme is not a code point. The flag emoji 🇯🇵 is one thing you see but two code points (regional indicators J + P), and 👍🏽 is one emoji but two code points (thumbs-up + skin-tone modifier). If you slice a string by code point or by UTF-16 unit you can cut an emoji in half and corrupt it. Use the grapheme count this tool shows for anything user-facing.

• `String.length` in JavaScript counts UTF-16 code units, not characters. `'𝄞'.length` is 2, not 1, because the G-clef lives above U+FFFF and needs a surrogate pair. Use the code-point count (`[...str].length`) for real character counts, and never assume one index step equals one character.

• Stripping spaces with `.replace(/ /g, '')` misses the invisible ones. U+00A0 no-break space, U+200B zero-width space, U+FEFF BOM, and U+3000 ideographic space all read as whitespace to a human but not to a naive regex. Copy the exact code point from this tool and target it specifically.

Privacy