Character Encoding & Economics Published 2026-09-06 • 7 min read

Zero-Width Space Attacks and Accidental SMS Segment Inflation in Modern Web Forms

Understand how invisible zero-width spaces (U+200B) and hidden Unicode characters inflate SMS segment billing. Build sanitization pipelines to strip invisible bytes.

Key Takeaway & Executive Summary

Invisible zero-width characters copied from rich-text editors secretly trigger UCS-2 encoding and multi-segment billing; sanitize input strings before dispatch.

One of the most insidious bugs in messaging engineering involves zero-width spaces (U+200B), zero-width joiners (U+200D), and byte-order marks (U+FEFF). These characters are completely invisible in text editors and browser forms, yet they trigger immediate UCS-2 encoding and segment explosion.

1 The Zero-Width Segment Bomb Explained

Consider a standard 100-character welcome message. If a copywriter inadvertently pastes a hidden Zero-Width Space (U+200B) from Notion or Google Docs:

- The text appears completely normal on screen.
- Carrier encoding engines detect Unicode and switch from GSM-7 to UCS-2.
- Maximum segment capacity drops from 160 to 70 characters.
- The 100-character message now costs 2 billable segments instead of 1.

2 Sanitization Regex Implementation

Deploy pre-send sanitization to strip zero-width artifacts:

Python: re.sub(r'[\u200B-\u200D\uFEFF]', '', text)
JavaScript: text.replace(/[\u200B-\u200D\uFEFF]/g, '')

Frequently Asked Questions • Character Encoding & Economics

Can zero-width characters be used maliciously?

Yes. Malicious actors can paste zero-width characters into user profile fields that are later concatenated into outgoing SMS notifications, intentionally inflating your carrier billing.

Related Technical Articles & Deep Dives

Copied to clipboard