Copied password does not work: hidden invisible characters
You pasted the password, the dots filled the box, and the site said it was wrong. The letters you can see may be fine — an invisible character often rode along with the copy.
Why the login box cannot warn you
A password field shows a dot for every character, visible or not. Twelve letters plus a zero-width space look exactly like twelve letters. The server then compares the exact bytes it stored with the exact bytes you sent, and they do not match.
This is different from caps-lock or a wrong keyboard layout: those change letters you can see if you reveal the password. Invisible characters stay hidden even then, unless the reveal font draws a placeholder for them (most do not).
Where the extra character comes from
| Source | What often sneaks in |
|---|---|
| Slack, Teams, Discord, iMessage | A zero-width space used for wrapping or “copy code” buttons; a trailing newline |
| Email and newsletters | A non-breaking space around a “password:” label, or a soft hyphen from a line break |
| Word, Google Docs, PDFs | Non-breaking spaces, soft hyphens (U+00AD), sometimes a byte-order mark if you saved then copied |
| Markdown and documentation sites | Zero-width spaces used to break long tokens so they wrap |
| A “Click to copy” button | Whatever the page put in the clipboard, which may include markup leftovers |
Password managers usually copy a clean value. The trouble starts when the secret was sent as ordinary text — “the password is …” — and then highlighted with the mouse.
trim() will not always save you
If a site strips whitespace from the password field before checking it, that only helps with characters the language treats as spaces.
| Character | Code point | JavaScript trim() | Python str.strip() |
|---|---|---|---|
| Ordinary space | U+0020 | Removed | Removed |
| Non-breaking space | U+00A0 | Removed | Removed |
| BOM / zero-width no-break | U+FEFF | Removed | Kept |
| Zero-width space | U+200B | Kept | Kept |
| Zero-width joiner / non-joiner | U+200D / U+200C | Kept | Kept |
| Soft hyphen | U+00AD | Kept | Kept |
So a copied password that “looks trimmed” can still fail. The same trap breaks API tokens, licence keys and OTP codes pasted from chat.
How to check without sending the real password anywhere
- Type it by hand into the login box. That is the safest fix and usually the fastest.
- Check the length you expect. If the password should be 16 characters and a local editor’s status bar says 17, something invisible is there.
- In a local editor: turn on “Render whitespace” or “Unicode highlight” (VS Code), or inspect with
python3 -c "print(repr(open('clip.txt').read()))"after pasting into a file. - On this site: the word and character counter and the text diff run entirely in your browser and never upload what you paste. Even so, do not paste a live password into any website. Change a few letters first, or use a dummy string that has the same copied junk around it.
- Do not send a live password to an API, including Anvil’s text X-ray (it does not store input, but the string does leave your machine).
A one-line check in the browser console, again only on a string you are happy to inspect:
// Characters that trim() will not remove
[...text].map(c => c.codePointAt(0).toString(16).padStart(4, "0") + " " + JSON.stringify(c))
If you are the one sending a password to someone
Do not put it in email or chat, where copy-paste and retention both work against you. A one-time note or a write-only letterbox keeps the secret out of two inboxes: see Fusenote’s how to ask for a password and the letterbox. The reply page can show a last look, including hidden spaces, before the sender posts — and they cannot read it back afterwards.
For a hands-on look at the same hidden marks, Wirebook’s ghost-footprints lesson puts a lens over them.
Related
File names with look-alike or invisible characters, and name collisions · Invisible zero-width characters · Strings that look the same but are not equal · Non-breaking space vs space · Look-alike (homoglyph) characters · Word and character counter · Wirebook: invisible characters · Fusenote: ask for a password
Questions
Why does a copied password fail when it looks correct?
An invisible Unicode character, often a zero-width space, was copied with it. Password fields hide every character, so you cannot see the extra mark, and the server compares the exact bytes.
Will trimming the password fix it?
Only if the extra character is whitespace. JavaScript trim() and Python strip() remove ordinary spaces and non-breaking spaces, but they leave zero-width spaces in place.
How do I see hidden characters in a password?
Do not paste a live password into a website. Type it by hand, or inspect a copy you have already changed in a local editor with whitespace visible, or check that the length matches what you expect.
Can a password manager cause this?
Rarely. Managers usually copy a clean value. The usual source is a password that was written out in chat, email or a document and then highlighted with the mouse.
Does this also affect API tokens and one-time codes?
Yes. The same hidden characters break pasted tokens, licence keys and OTP codes. Retype them, or copy from the original source rather than from a forwarded message.
Published .