Joiners, selectors and fillers
TAG CHARACTERS (U+E0000–U+E007F)
A shadow copy of ASCII. U+E0020–U+E007E mirror the printable ASCII characters, one for one, and render as nothing. U+E007F CANCEL TAG ends a sequence.
- Range
U+E0000–U+E007F- Category
- Joiners, selectors and fillers
- Removed by default
- When free-floating
- Governing option
- Aggressive
-a - Can be load-bearing
- Yes
Where it comes from
Their only current sanctioned use is inside subdivision flags: 🏴 followed by the tags for "gbsct" and a cancel tag is the Scotland flag. Everything else is deliberate — this is the block behind "ASCII smuggling", where an invisible instruction is appended to a prompt or a document.
Why it matters
This is the most dangerous family on this list. A tag sequence is invisible to a human reviewer, is copied and pasted intact, and is read as ordinary text by many language models — which is how a benign-looking paragraph can carry an instruction the reader never sees. If you are reviewing untrusted text before it reaches a model, this is the block to check first.
Before and after
Six tag characters spelling a word no reader can see. Ghostchars shows each one with its position and its ASCII twin.
The character is shown as a labelled chip so you can see where it sits. In your text it draws nothing at all.
When it is legitimate
Inside a complete subdivision flag sequence: a black flag base, one or more tag characters, and a cancel tag. Ghostchars parses the whole sequence and keeps exactly those; a tag character that is not inside a valid flag is free-floating and is removed.
How to remove it
Free tag characters are removed by the default pass. Valid flag sequences are kept and reported; `-a` removes those too and leaves you with a plain black flag.
Is it an AI watermark?
Used to hide data — not a watermark
No — and this is the one worth being precise about. Tag characters are not a watermark left by a model; they are an attack surface pointed AT models. A tag sequence in text you are about to paste into an assistant is a prompt injection until proven otherwise.
A known carrier for deliberately hidden payloads. Someone put it there on purpose, which is a different question from who wrote the words.
Questions
What is ASCII smuggling?
Encoding readable ASCII text in the tag block so it is invisible on screen but still present in the string. Anything that reads the raw text — including many language models — can act on it.
Will it break the Scotland or Wales flag?
No. Those flags ARE tag sequences: a black flag, the subdivision code in tag characters, and a cancel tag. Ghostchars validates the whole sequence and keeps it, and only `-a` removes it.
Should I clean text before pasting it into an AI assistant?
If the text came from somewhere you do not control, yes. Invisible instructions in the tag block are the standard delivery mechanism for indirect prompt injection.
Check your own text
Paste anything into the cleaner to see every hidden character it contains, with position, codepoint and what happens to each one. Nothing is uploaded.