Unicode Steganography
Shows how to hide data inside ordinary text using zero-width characters and look-alike Unicode substitutions
Last verified:
What is Unicode Steganography?
Unicode Steganography is an interactive demo site that shows how invisible or look‑alike Unicode characters can hide data inside ordinary text. The site presents multiple techniques—zero‑width characters, homoglyph (Latin↔Cyrillic) substitution, and variation selectors—explaining how each encodes a binary stream into a visible carrier while preserving human‑readable appearance. Each technique page summarizes tradeoffs (capacity, detectability, robustness) and provides short interactive examples so visitors can encode and decode sample messages to observe how the hidden payload is embedded. The project is designed as an educational demo and threat model: it explains where these techniques succeed (e.g., passing casual human inspection, surviving copy/paste in some pipelines) and where they fail (e.g., Unicode normalization, client stripping, or simple scanners), making it useful for security researchers, developers, and anyone studying adversarial uses of plain text for secret channels.
Unicode Steganography pricing
Pricing model: Freemium
The website is an educational demo and is presented free to use; there are no paid plans or commercial tiers described on the site. All demonstrations, explanations, and sample encode/decode interactions are available without charge.
Unicode Steganography pros
- Interactive, hands‑on demos for each technique
- Clear explanation of zero‑width character encoding
- Homoglyph substitution demo with Latin↔Cyrillic pairs
- Variation selector technique illustrated with examples
- Side‑by‑side tradeoff discussion (capacity, detectability, robustness)
- Shows platform behaviors like copy/paste survival
- Explains normalization and stripping failure modes
- Practical for threat‑modelling LLM deception scenarios
- Explains how different carrier choices affect capacity
- Identifies which clients strip or preserve hidden data
- Concrete limits given (e.g., number of substitutable pairs)
- Educational for developers building Unicode scanners
- Easy to reproduce results locally from explanations
- Demonstrates both visible and invisible steganography approaches
- Focused on real Unicode implementation details (code points and behaviors)
Unicode Steganography cons
- Not a production tool or hosted service for secure messaging
- Interactive demo lacks detailed API or SDK for integration
- Zero‑width payloads are trivially detected by Unicode scanners
- Some techniques rely on small set of homoglyph pairs (low capacity)
- Variation selectors can be reordered or dropped by normalization
- Many platforms (Slack, Twitter/X, email clients) strip invisible chars
- No built‑in persistence or storage for encoded messages
- No automated detection tooling bundled with the demo
Frequently asked questions about Unicode Steganography
Which hiding techniques are demonstrated on the site?
The site demonstrates three main techniques: zero‑width characters (inserting invisible code points to carry bits), homoglyph substitution (replacing visible characters with visually identical characters from another script like Cyrillic to encode bits), and variation selectors (using Unicode variation selectors appended to graphemes to carry data).
Will hidden messages survive copy and paste?
It depends on the technique and destination: homoglyph substitutions generally survive copy/paste across platforms, while zero‑width characters are often stripped by chat platforms or email clients; variation selectors may survive but can be affected by normalization or font rendering differences.
How detectable are these methods by automated scanners?
Zero‑width characters are easy to detect with a Unicode category check or hex inspection; homoglyph substitution can be detected by comparing codepoints against a Latin/Cyrillic reference; variation selectors are detectable by inspecting code points and selector ranges—overall, a scanner specifically looking for these techniques will flag them reliably.
What are the capacity limits for each technique?
Capacity varies: zero‑width insertion scales with carrier length (high capacity), homoglyph substitution is capped by the number of substitutable characters (the demo notes only 21 Latin↔Cyrillic pairs in its implementation), and variation selector capacity depends on how many selectors can attach to visible graphemes and how the carrier text is structured.
Which platforms or clients commonly destroy hidden payloads?
The demo explicitly calls out that Slack, Twitter/X, many email clients, and other similar services often strip zero‑width characters; normalization steps in some pipelines also remove or alter variation selectors, making those payloads fragile on certain platforms.
Is the technique stealthy against human readers?
Yes—human readers generally cannot see zero‑width or homoglyph substitutions and the visible text looks unchanged, which is precisely why these methods are useful for hiding messages from casual inspection; however, technical inspection easily reveals the hidden content.
Can these methods be used to hide binary data or only text?
Both text and arbitrary binary can be encoded: the demo describes encoding binary payloads (e.g., bytes) into zero‑width sequences or other carriers by converting bytes to a base matching the set of steward characters, so binary payloads are supported in principle.
Do normal spellcheckers or grammar tools catch these substitutions?
Often not—many spellcheckers and grammar tools operate on rendered graphemes and will accept lookalike characters from other scripts, so homoglyph substitutions can bypass simple spelling checks; however, script‑aware checks or codepoint analysis will detect mismatches.
How robust are these techniques to Unicode normalization?
Robustness varies: normalization to NFC/NFKC can remove or alter zero‑width sequences and variation selectors; homoglyph substitutions are less affected by normalization but can still be normalized in pipelines that map lookalikes, so normalization can break or eliminate hidden payloads.
Who should use this demo and why?
Security researchers, developers building content‑filtering or detection systems, educators, and anyone studying adversarial channels or LLM deception should use the demo because it clearly illustrates practical steganography techniques, their tradeoffs, and how simple inspections can detect them.