Detect Zero-Width Characters Fingerprinting



How Can Zero-Width Characters Fingerprinting Be Detected?

Just about every modern web browser that one uses supports zero-width characters. The characters might be added on to the text of a page without the user even knowing, as, the characters cannot be identified by the naked eye.

Tom Ross is a British security researcher who had described how zero-width characters could be used for adding the username to a logged area and for a text that had been copied by the user. The paste jobs would include the invisible information and the only thing that is needed to reveal the hidden characters are checks.

Although the method might not work at all for the user’s fingerprint, zero-width characters might still be used so as to reveal important leak information or even the source of the leaks.

The characters are invisible to our naked eye and when the copied text has been pasted, they might not show up either. In case the text is pasted into an editor that has a spell-checker, you would notice that there are spell-checking flags that would show up, even though everything looks perfectly normal.

However, this can be easily avoided by having the characters added to the end or the beginning of the words, as long as it is not in the middle of the text. A proof of concept had been published by Ross, in which he had the username of the users converted to binary, a list of one and zero characters, to reproduce the username using the zero-width characters.

What is it that one can do to detect if the text includes zero-width characters?

First of all, one can have the text pasted into an editor (with diff checker) as it would reveal these characters. You can go to a - diff checker - and have the text pasted on the left side of the editor. Upon doing this, one would immediately notice that the editor displays the zero-width characters in the text.

Another option is the Chrome extensions as it would replace the zero-width characters with emojis. The zero-width characters would be replaced by the extension when detected on websites by emojis. All you have to do is installing the extension and activate it to reveal any hidden zero-width characters that are on the page. When you want to copy a text, you might want to have the extension activated, especially, if one is in a situation where they do not want the text pasted to be tracked by zero-pixel characters.


One thing is for sure and that is zero-width characters are the latest thing which users need to actively be on the lookout for whenever they are browsing the web. Using the extensions can come in handy and help avoid being tracked.

Comments and feedback