Check Copied Text Before Pasting It into AI
SafePaste inspects whatever you have copied — before you paste it into ChatGPT, Claude, Cursor, an email or a document — and reveals anything hidden inside. It flags invisible and zero-width Unicode, bidirectional "Trojan Source" controls, look-alike characters, hidden AI prompt-injection instructions, unsafe HTML, tracking pixels and tracking links, then gives you a clean plain-text or sanitized rich-text version to paste instead. Everything runs locally in your browser; nothing you paste is ever uploaded or stored.
- 100% free
- Private & safe
- Runs in your browser
Why use SafePaste – Clipboard & AI Prompt Scanner?
SafePaste – Clipboard & AI Prompt Scanner runs entirely in your browser to make AI workflows safer — scanning and cleaning content locally so nothing you paste is uploaded or logged.
- Runs instantly in your browser — nothing to install, nothing uploaded.
- Completely free, with no account, no watermarks and no usage limits.
- Handles Plain text (text/plain); Rich text / HTML (text/html).
- Copy any text or rich content from a website, email, PDF or chat.
- Works on any device — desktop, tablet and phone — and is fully keyboard accessible.
What it can do — and its limits
- Detects invisible/zero-width characters, bidirectional controls and Unicode tag characters.
- Flags AI prompt-injection phrasing, including instructions hidden inside invisible runs.
- Scans rich HTML for scripts, event handlers, hidden text, comments and tracking pixels.
- Removes tracking parameters (utm_*, fbclid, gclid, and more) while keeping links working.
- Outputs cleaned plain text and sanitized rich text you can copy back to the clipboard.
How to use SafePaste – Clipboard & AI Prompt Scanner
- Copy any text or rich content from a website, email, PDF or chat.
- Click the paste box and press Ctrl/Cmd + V, or use "Read clipboard".
- Read the safety score and the list of exactly what was detected.
- Compare the visible text with the actual content, with hidden characters revealed.
- Copy the cleaned plain text or sanitized rich text to paste safely.
Examples
- Checking text copied from a webpage before pasting it into an AI assistant.
- Removing invisible watermark characters added by another AI tool.
- Stripping utm_ and fbclid tracking parameters from shared links.
- Detecting white-on-white hidden instructions inside pasted rich text.
Supported formats & limits
- Plain text (text/plain)
- Rich text / HTML (text/html)
Limitations
- Pattern-based detection flags likely prompt injections; it cannot guarantee intent.
- Reading the clipboard automatically requires browser permission — pasting always works.
- Confusable detection covers common Latin/Cyrillic/Greek look-alikes, not every Unicode script.
Sources & references
Frequently asked questions
What are invisible or zero-width characters?
They are Unicode characters that take up no visible space, such as the zero-width space (U+200B) or word joiner (U+2060). They are usually harmless but can hide instructions, watermarks or be used to evade filters.
What is an AI prompt injection?
Text — often hidden in invisible characters or white-on-white HTML — that tries to make an AI assistant ignore its instructions or take unintended actions. SafePaste flags instruction-like phrasing so you can remove it before pasting.
Is my clipboard content uploaded anywhere?
No. All scanning and cleaning happens locally in your browser. Nothing you paste is transmitted or stored.
What is a Trojan Source attack?
It uses bidirectional Unicode control characters to make text (especially source code) display differently from how it is actually interpreted, hiding malicious content in plain sight.
What is the difference between clean plain text and sanitized rich text?
Clean plain text strips all invisible/bidi characters and optional trackers, leaving only readable text. Sanitized rich text keeps safe formatting (bold, links, lists) but removes scripts, comments, hidden elements, tracking pixels and tracking parameters.