Skip to content
Ghostchars

Bidirectional overrides

RIGHT-TO-LEFT OVERRIDE (U+202E)

An invisible control that forces every following character to be laid out right to left, regardless of what script it belongs to.

Codepoint
U+202E
Also written as
u202e\u202e‮
Removed by default
Yes
Governing option
No option needed
Can be load-bearing
No

Copy and paste U+202E

To copy and paste RIGHT-TO-LEFT OVERRIDE (U+202E), press the button: the character itself goes to your clipboard, and Ctrl+V (Cmd+V on a Mac) pastes it anywhere you can type.

Careful: this is a bidirectional control. Pasted into a file name, a message or source code, it can make the text display in a different order from the one it is stored in.

Where it comes from

Almost never from legitimate text. Its fame comes from the "right-to-left override" filename attack: `invoice‮fdp.exe` displays as `invoiceexe.pdf`, and the user double-clicks an executable thinking it is a document.

Why it matters

It changes what the reader sees without changing what the computer reads. That is the definition of a spoofing character: the displayed order and the logical order disagree, so a filename, a URL or a code identifier can be made to look like something it is not.

Before and after

RIGHT-TO-LEFT OVERRIDE (U+202E) before and after cleaning, with the hidden character shown as a labelled chip
Reference card for this character: the codepoint, the verdict, and the same before and after in one image.
BeforeinvoiceU+202Efdp.exe
Afterinvoicefdp.exe

Before cleaning, most software displays this as "invoiceexe.pdf". The bytes never said that.

The character is shown as a labelled chip so you can see where it sits. In your text it draws nothing at all.

When it is legitimate

Effectively never in prose. Correct bidirectional text is produced by the Unicode bidi algorithm from the characters themselves, and where an explicit hint is needed the isolates (U+2066-U+2069) are the modern, safe choice.

How to remove it

The default pass removes it, in every context, with no option to keep it. Ghostchars treats all five embedding and override controls the same way.

Working in a file rather than a paste? The document report for .docx, .odt and .html finds it inside the file, together with hidden runs and tracked changes, without you having to open it. If the question is what the rest of the writing does rather than what this one character does, count the tell words and phrases per thousand words and see where each habit sits, with no score and no claim about who wrote the text.

Is it an AI watermark?

Not a watermark

No. This is a spoofing tool, not a provenance mark. If you find one in a filename, a package name or a source file, treat it as hostile rather than as a curiosity.

No connection to machine-generated text. It comes from software, from a keyboard, or from a person.

Questions

What is the RTL override filename attack?

Placing U+202E inside a filename reverses the display of everything after it, so an executable can be shown with a document extension. The file on disk is unchanged; only the rendering lies.

Does it matter in source code?

Yes. Bidi controls inside comments and string literals can make reviewed code display differently from what compiles. Most compilers now warn about them.

Is there ever a reason to keep it?

Not in text you are cleaning. Real bidirectional text does not need it, and the isolate characters do the same job without reordering unrelated text.

Check your own text

Paste anything into the cleaner to see every hidden character it contains, with position, codepoint and what happens to each one. Nothing is uploaded.

Check your own textClean it in Chrome as you pasteClean it on your Mac with one keystrokeAll characters

Anonymous usage stats?

Ghostchars processes your text in the browser and never uploads it. We would like to count page views with a self-hosted, cookie-light analytics endpoint. No content, ever.