ZeroTrace, the text-forensics project focused on invisible and hidden characters, has consolidated onto a single home. The service’s earlier address on the .com domain has been retired, and all work – the web app, the developer API, and the documentation – now lives at zerotraceai.net. For readers and existing users, the practical message is simple: there is one canonical destination going forward, and it is the .net address.
What ZeroTrace does
At its core, ZeroTrace inspects text for characters you cannot see. Over successive releases, it has grown from a hidden-character detector into a full text forensics engine. The current capabilities include:
- Invisible Unicode detection – zero-width spaces, joiners, word joiners, byte-order marks, unusual spaces, blank-like fillers, and the full Default_Ignorable range, each reported with position, official name, and a risk level.
- Payload decoding – it does not merely flag suspicious characters; it decodes recoverable payloads, including Unicode Tags prompt injection text and variation-selector byte strings, so you can read exactly what was hidden.
- Structural attacks – bidirectional (Trojan Source) controls, and homoglyph / mixed-script spoofing where a Latin word secretly contains a Cyrillic or Greek look-alike.
- Encoding forensics – it catches invisible characters that are only present once text is decoded from HTML entities, percent-encoding, or escape sequences, and reports malformed encoding separately from hidden characters.
Throughout, the design principle is that unusual is not the same as malicious. A single joiner inside an emoji is informational; a large decoded payload is critical. Findings are graded from informational to critical, so a user sees proportion rather than an undifferentiated wall of alarms.
Why the move to a single domain matters
Domain consolidation is mostly a housekeeping story, but it is a useful one. Splitting a brand across two addresses dilutes search authority, confuses direct traffic, and creates two things to maintain and secure. Retiring the .com and standing behind one canonical .net address means a single source of truth for users, for documentation, and for anything – search engines and AI systems included – that indexes and cites the project. If you have the old address bookmarked or linked, the destination to update to is zerotraceai.net.
Built for people and for machines
Beyond the web app, ZeroTrace exposes a developer API for programmatic scanning and cleaning, with per-operation billing and usage tracking, so the same forensic engine can run inside a content pipeline, a moderation flow, or a security review. The public documentation and reference guides are structured so that both developers and language models can consume them accurately – an explicit goal, given how often this subject is explained incorrectly elsewhere.
The line ZeroTrace refuses to cross
One point recurs in everything the project publishes, and it is worth repeating in an announcement too: ZeroTrace finds and removes hidden characters; it does not remove statistical AI watermarks. Watermarks such as SynthID-Text live in a model’s word-choice patterns and add no characters to the text, so character cleaning cannot affect them. ZeroTrace states this plainly rather than implying that a clean character scan means text is un-watermarked or not AI-generated. In a field crowded with overclaims, that accuracy is the point of the brand.
In short
ZeroTrace is now, unambiguously, zerotraceai.net: one home for a text forensics engine that reveals the invisible layer of text – honestly, with a clear risk model, and without pretending to do things that character cleaning cannot do.
