Bidirectional overrides
RIGHT-TO-LEFT OVERRIDE (U+202E)
An invisible control that forces every following character to be laid out right to left, regardless of what script it belongs to.
- Codepoint
U+202E- Category
- Bidirectional overrides
- Removed by default
- Yes
- Governing option
- No option needed
- Can be load-bearing
- No
Where it comes from
Almost never from legitimate text. Its fame comes from the "right-to-left override" filename attack: `invoicefdp.exe` displays as `invoiceexe.pdf`, and the user double-clicks an executable thinking it is a document.
Why it matters
It changes what the reader sees without changing what the computer reads. That is the definition of a spoofing character: the displayed order and the logical order disagree, so a filename, a URL or a code identifier can be made to look like something it is not.
Before and after
Before cleaning, most software displays this as "invoiceexe.pdf". The bytes never said that.
The character is shown as a labelled chip so you can see where it sits. In your text it draws nothing at all.
When it is legitimate
Effectively never in prose. Correct bidirectional text is produced by the Unicode bidi algorithm from the characters themselves, and where an explicit hint is needed the isolates (U+2066–U+2069) are the modern, safe choice.
How to remove it
The default pass removes it, in every context, with no option to keep it. Ghostchars treats all five embedding and override controls the same way.
Is it an AI watermark?
Not a watermark
No. This is a spoofing tool, not a provenance mark. If you find one in a filename, a package name or a source file, treat it as hostile rather than as a curiosity.
No connection to machine-generated text. It comes from software, from a keyboard, or from a person.
Questions
What is the RTL override filename attack?
Placing U+202E inside a filename reverses the display of everything after it, so an executable can be shown with a document extension. The file on disk is unchanged; only the rendering lies.
Does it matter in source code?
Yes. Bidi controls inside comments and string literals can make reviewed code display differently from what compiles. Most compilers now warn about them.
Is there ever a reason to keep it?
Not in text you are cleaning. Real bidirectional text does not need it, and the isolate characters do the same job without reordering unrelated text.
Check your own text
Paste anything into the cleaner to see every hidden character it contains, with position, codepoint and what happens to each one. Nothing is uploaded.