Unicode tag characters: how a whole message hides inside plain text
The U+E0000 block renders as nothing anywhere. It can carry an entire hidden payload attached to ordinary words.
Hidden characters · 2 min read
There is a block of Unicode, U+E0000 to U+E007F, that has no visible rendering in any font, on any platform, by design. It is called the Tags block, and it mirrors printable ASCII: U+E0041 corresponds to A, U+E0042 to B, and so on.
Which means you can write an entire message in it, append that message to ordinary text, and the result looks completely unchanged.
Why this exists
The block was introduced for language tagging in plain text, an approach that was deprecated almost immediately in favour of proper markup. The codepoints stayed allocated. Today their only widespread legitimate use is inside a handful of emoji flag sequences.
So a document containing tag characters outside an emoji flag has essentially one explanation: something put them there deliberately.
What it looks like
The word tapestry followed by U+E0041 U+E0042 displays as:
tapestry
Identical. The two extra codepoints are in the data, take up bytes, and survive copy-paste. Paste that into a plain textarea and back out again and they come with it.
This has drawn real attention as a prompt-injection vector: instructions encoded in tag characters are invisible to a human reviewing a document but arrive intact in a model's input.
Why it matters for provenance
Any per-recipient identifier needs somewhere invisible to live, and the Tags block is roughly ideal:
- Invisible on every platform, not merely narrow.
- 128 codepoints, so a full ASCII payload with no encoding tricks.
- Not a whitespace character, so it slips through whitespace normalisation.
- Rarely handled by naive sanitisers, which tend to know about U+200B and stop there.
Finding and removing them
Two practical notes.
They are astral-plane characters. Above U+FFFF, so in JavaScript each occupies two UTF-16 code units. Iterating a string by index rather than by codepoint will split them and miscount. Any scanner worth trusting iterates codepoints.
Removal is lossless. Outside emoji flag sequences these codepoints carry no meaning in prose. Deleting them cannot alter what your text says — which makes this the easiest category to clean with confidence.
Scan your text and the report will show a TAG chip at each position, with an exact count. If your document has them, you will know precisely how many and where.
Related: zero-width characters · variation selectors