Hide a secret note inside an ordinary sentence. The message is turned into invisible zero-width characters, so the text looks exactly the same, yet anyone who pastes it here can reveal it. Add a passphrase to encrypt the hidden part. Everything runs in your browser.
Last updated:
Text with hidden message
Zero-width characters survive copy & paste in most chat apps, email and documents, but some sites and SMS strip them. Without a passphrase the message is hidden, not encrypted.
Advertisement
Advertisement
How to use the Hidden Message Encoder
Type the cover text: the normal sentence everyone will see.
Type your secret message and, if you like, a passphrase that the reader will need.
Press Hide message, then copy the result. It looks identical to the cover text.
Send or post the text anywhere that keeps Unicode characters, such as most chat apps, email and documents.
To read it, open Reveal, paste the text, enter the passphrase if one was used and press Reveal message.
How zero-width text steganography works
Steganography hides the fact that a message exists at all, while encryption hides what it says. This encoder uses four Unicode characters that take up no space and draw nothing on screen:
Character
Code point
Bit pair
Zero-width space
U+200B
00
Zero-width non-joiner
U+200C
01
Zero-width joiner
U+200D
10
Word joiner
U+2060
11
Your message is converted to UTF-8 bytes. Each byte is split into four 2-bit pairs, and each pair becomes one invisible character, so one byte costs four characters. A small header (marker byte, flags and length) and a Fletcher-16 checksum are added, which lets the decoder find the message reliably and detect damage. The invisible block is then inserted after the first word, spread between words, or appended at the end of the cover text.
Hidden vs. encrypted
Without a passphrase the message is only concealed. Anyone who pastes the text into a zero-width decoder can read it.
With a passphrase the hidden bytes are encrypted with AES-256-GCM before they are turned into invisible characters. The key is derived with PBKDF2-SHA256 (150,000 iterations) and a random 16-byte salt; a random 12-byte IV is used each time. A wrong passphrase or any change to the data is detected.
Encryption adds 44 bytes (salt, IV and authentication tag), which is 176 extra invisible characters.
Tips for reliable hidden messages
Test the platform first: send the text to yourself, copy it back and paste it into the Reveal tab.
Ask the reader to copy the whole text. With Spread between words, copying only part of the sentence loses part of the message.
Keep secrets short. Length limits (for example in social media bios or SMS) count invisible characters too.
Use the Reveal tab's Remove hidden characters button to clean text you received before reusing it, for example in code, file names or forms where invisible characters cause errors.
Frequently asked questions
How can a message be hidden in plain text?
Unicode contains characters that have no width and draw nothing, such as the zero-width space (U+200B), zero-width non-joiner (U+200C), zero-width joiner (U+200D) and word joiner (U+2060). This tool converts your message to bytes and writes each byte as four of these invisible characters (two bits each), then inserts them into the cover text. The text looks the same but carries extra data.
Is the hidden message secure?
Without a passphrase it is only hidden, not encrypted: anyone who suspects it and uses a zero-width decoder can read it. With a passphrase the hidden bytes are encrypted with AES-256-GCM using a key derived from the passphrase with PBKDF2-SHA256 (150,000 iterations), so only someone with the passphrase can read it.
Where does the hidden message survive?
It survives copy and paste in most places that keep Unicode text exactly, for example many chat apps, email, word processors, notes apps and plain .txt files. Some websites, social networks, SMS gateways and text cleaners strip zero-width characters or limit length, which destroys the message. Test with the Reveal tab before relying on a platform.
Why does the text show more characters than I can see?
Each byte of the secret becomes four invisible characters, so a 40-character message adds about 170 invisible characters (plus about 180 more when a passphrase is used). Character counters and length limits count them, even though nothing is shown.
Can I find hidden characters in a text I received?
Yes. Paste it into the Reveal tab. The tool decodes messages made with this encoder and also reports any other invisible characters it finds, such as zero-width spaces, joiners or byte order marks, and can remove them all.
Is my text sent anywhere?
No. Encoding, encryption and decoding run entirely in your browser with standard JavaScript and the WebCrypto API. Nothing is uploaded or stored.
Why do emoji sometimes contain zero-width joiners?
Many emoji, such as family or profession emoji, are built from several emoji glued together with U+200D zero-width joiners. The decoder ignores these single joiners, so emoji in the cover text do not break the hidden message.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.