Zero-width spaces that break your build. Bidirectional overrides that make code read one way and run another. Tag characters carrying a hidden message. They ride along whenever you copy out of a web page, a chat window or an AI assistant. Some are also used as deterministic, character-level watermarks. Nullspace shows the exact evidence, removes the selected carriers, and verifies the result without guessing who put them there.
Every hidden character is drawn as a labelled block. Everything else is your text, unchanged.
A zero-width space (U+200B) copied out of a web page, a chat client or a
model's answer is invisible in every editor but is a real character to the parser. The
same goes for a non-breaking space instead of a plain one, and for a byte order mark
sitting in front of your first line. Paste the line in and you will see it.
This is the same problem one layer down: a trailing U+200B, a
U+00A0 where a space should be, or a Cyrillic а standing in for
a Latin a. It breaks database keys, deduplication, CSV imports, JSON keys,
grep and diffs. Nullspace reports the codepoint so you can prove which it is.
Very common, and usually this. Text copied out of a chat interface arrives with the
formatting of the page it was rendered in: a non-breaking space instead of a space, curly
quotes instead of ", an en dash instead of a hyphen, sometimes a zero-width
character between two tokens. Every one of them is invisible in your editor and fatal to a
parser. Paste the snippet in and you will see exactly which character and exactly where.
Bidirectional overrides such as U+202E reorder how text is displayed
without changing what it is. Dropped into source, a comment can appear to end
where it does not, so a reviewer reads one program and the compiler builds another. This
is CVE-2021-42574. Any bidi control in otherwise left-to-right text is flagged here.
The Unicode tag block (U+E0000–U+E007F) mirrors ASCII and
renders as nothing at all, so an arbitrary message can be carried invisibly inside
ordinary-looking text. It is a live prompt-injection technique against AI assistants.
Nullspace decodes what the payload actually says and shows it to you.
Because that corrupts real text. U+200D is what holds
👨👩👧 together as one family emoji; strip it and you
get three separate people. In Persian, U+200C is not decoration but spelling
— میروم is a word and میروم is not.
Hindi, Bengali, Tamil and Malayalam use the same joiners to control conjuncts. Nullspace keeps
a joiner that is doing a job and removes one that is not. That check is on by default and
you can turn it off.
It removes deterministic character-level carriers: hidden tags, zero-width characters, bidirectional controls and selector channels. Statistical token-choice watermarks such as SynthID-Text are different: their detector needs the matching tokenizer, watermark keys or configuration, and calibrated thresholds. Nullspace neither tests that layer nor claims a vendor from Unicode evidence. For C2PA and file metadata, use Metascrub.
Yes. Download the chat extension,
extract it, then load that folder from your browser's extensions page with Developer mode
enabled. Focus any chat composer and click the pinned Nullspace icon or press
Alt+Shift+N. It requests temporary access only when activated and includes
one-click undo.
No. There is no server and no backend. Everything happens in the page you already downloaded — open your browser's network tab and watch, or turn off your wifi and use it anyway. The page counts anonymous opens and nothing else; Do Not Track turns even that off.