Prompt Injection Linter
Paste a prompt, a scraped web page, or an untrusted tool output and see any hidden instructions, invisible characters, or lookalike letters hiding inside it, before you hand that text to an AI agent.
Could not scan this input:
Paste text above and click Scan, or click Load example to see a hidden payload decoded in one click.
What it checks
Five passes run over the pasted text every time you click Scan. Each one is a plain string/Unicode check, no AI model is involved in any of them.
-
Invisible / zero-width characters: characters like zero width space
(U+200B), zero width joiner (U+200D), and the byte-order-mark character (U+FEFF) that
render with no visible width. Example:
passworddisplays as "password" but carries an extra invisible character in the middle. - Unicode tag characters (U+E0000 to U+E007F): a block that mirrors the ASCII table one-to-one but is invisible in every standard renderer. An attacker spells out an instruction using these characters and appends it to normal-looking text; a human sees nothing extra, a model reading the raw string sees the instruction. This tool decodes anything found in this range back to readable text. Example: the built-in fixture.
-
Bidi override / isolate characters: direction-control characters
(U+202A to U+202E, U+2066 to U+2069) that can reorder how text displays. The classic
misuse is disguising a file's real extension, for example making a file named with a
right-to-left override character display as
invoice.exewhen it is actually named the reverse. -
Homoglyphs: Cyrillic or Greek letters that look almost identical to an
ASCII letter. Example:
pаypal.comwhere the second letter is Cyrillicа(U+0430), not Latina, used in phishing domains and to slip text past filters that only check ASCII. - Suspicious phrase heuristics: a small curated list of common injection/jailbreak phrasing ("ignore previous instructions", "system:", "disregard", "you are now", and similar). This is a keyword match on the visible text, not a security boundary: it is easy to rephrase around, and it can flag innocent text that happens to contain the same words.
Sources
- Palo Alto Networks Unit42, indirect prompt injection observed in the wild on real web pages: https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
- Promptfoo, zero-width Unicode can silently backdoor AI-generated code: https://www.promptfoo.dev/blog/invisible-unicode-threats/
- Anthropic, research on prompt-injection defenses: https://www.anthropic.com/research/prompt-injection-defenses
- Marco Gerber, ASCII smuggling: a threat hidden in plain sight (tag-character technique): https://marcogerber.ch/ascii-smuggling-a-threat-hidden-in-plain-sight/
- CloudThat, defending LLM applications against Unicode character smuggling: https://www.cloudthat.com/resources/blog/defending-llm-applications-against-unicode-character-smuggling
Everything happens on your device. Nothing you type here is sent anywhere.