Forms

Invisible Text for Forms

An invisible character can bypass a required field on forms that only test for emptiness — a blank forms invisible word that satisfies the check while showing nothing. This page covers why that works, where it fails, and how to close it in validation you control.

Why a blank form input can bypass required field validation

Most required-field checks test length, not content. The common implementation is value.trim().length > 0, and a character that survives the trim satisfies it while displaying nothing.

The check was written to catch a genuinely empty field, which is the case it handles correctly. It was not written to establish that a human supplied a meaningful answer, and it cannot tell the difference.

This is why "field cannot be empty" persists when you press the spacebar. U+0020 has the Unicode property White_Space=Yes, so trim() removes it and the trimmed value is still empty. A character with White_Space=No is not removed, so the length test passes.

Where it fails

Four kinds of validation reject it, and they are increasingly common.

  • Trimming validators. A form that trims before checking removes everyZs character, so U+00A0 and every space variant fail. OnlyCf, Lo and So characters survive.
  • Shape validation. A field expecting an email address, a phone number or a date checks the pattern, not the presence. No invisible character matches those patterns.
  • Server-side validation. A client-side check is a convenience. A server that revalidates sees the codepoint plainly, and increasingly strips it.
  • Non-text inputs. A required radio group, checkbox or dropdown has no text field to paste into. Nothing about invisible characters applies.

Google Forms and survey responses

A required short-answer question accepts an invisible character; a validated one does not. Google Forms checks for a non-empty response rather than for visible content.

A blank text survey response reaches the spreadsheet as a cell that looks empty and is not, which creates the same downstream problem described on the Excel guide — the value parses as text, sorts oddly and breaks a COUNTIF against an empty string.

Worth being direct about the consequence. A required survey question is usually required because the answer is the point of collecting it. A blank submission is not a neutral act toward whoever is reading the results — it is a row of data that looks answered and is not.

How to close it in your own validation

To reject invisible input, normalize and strip before you measure length. Checking the trimmed length alone will always be defeatable, because trimming only handles the Zs category.

In JavaScript:

  • Strip format characters — value.replace(/\p{Cf}/gu, "")
  • Fold odd spaces — .replace(/\p{Zs}/gu, " ")
  • Then .trim() and check the length

Two cautions carry over from the detector. U+200D Zero-Width Joiner is structural inside emoji, and U+200C Zero-Width Non-Joiner is orthographically required in Persian, Hindi and Bengali. Stripping all Cf characters from free-text fields breaks both. Apply the strict rule to identifiers and short answers, not to a comments box.

The stronger fix is to validate the shape of the answer rather than its presence. A field that requires a minimum word count, a matching pattern or a value from a known set cannot be satisfied by a character that carries no information.

When this is ordinary work

Testing your own form is exactly what this technique is for. An invisible character is a useful fixture: it proves whether a sanitiser handles non-ASCII blank input before a real user finds out that it does not.

Three uses are unambiguous. Testing validation on a form you own or maintain. Filling a field that is technically required and genuinely not applicable, where no other option exists. Building QA fixtures that exercise the empty-but-not-empty case.

Submitting blank answers to someone else's research, or to a form where the answer carries consequences for another person, is a different thing wearing the same technique. The codepoint is neutral; what you do with it is not.

Frequently asked questions

01

Does an invisible character bypass a required field?

Yes, on forms that only check whether the field is empty. An invisible character has a non-zero length, so a check like value.length > 0 passes. A form that trims before checking, or that validates the shape of the answer, rejects it.

02

Which character works in a form field?

U+00A0 No-Break Space passes the widest range of naive checks, because many validators treat it as an ordinary character rather than whitespace. U+3164 and U+2800 also work and survive a trim, which U+00A0 does not.

03

Can I leave a Google Forms answer blank if it is required?

Sometimes. A required short-answer question accepts an invisible character, because Google Forms checks for a non-empty response rather than for visible content. Multiple-choice and validated questions do not — there is nothing to paste into them.

04

How do I fill a required field with blank input?

Paste an invisible character instead of pressing the spacebar. To fill required field with blank content you need a codepoint that survives trimming — U+3164 or U+2800 — because every space character is removed before the check runs.

05

Why does the field cannot be empty bypass stop working?

Because the form started validating properly. A field cannot be empty bypass only defeats a naive length check; once the form strips General Category Cf and folds Zs before measuring, nothing invisible passes.

06

Is this detectable?

Yes, trivially, by anyone who looks. The submitted value contains a real codepoint, so a server-side check, a spreadsheet export or a regex match on \p{Cf} all reveal it. It defeats a client-side emptiness check and nothing else.

07

Why does the field cannot be empty error persist?

The form trims the input before checking. Every space character has White_Space=Yes and is removed by trim(), so the trimmed value is empty and the error stands. Switch to U+3164 or U+2800, which are not trimmed.

08

How do I stop invisible characters passing my own form validation?

Normalize and strip before validating. Remove General Category Cf entirely, fold Zs to a plain space, then trim and check the length. Validating the shape of the answer rather than its presence closes it completely.

09

Is using invisible text in a survey a problem?

It depends on whose form it is. Testing your own validation is ordinary QA work. Submitting a blank answer to someone else's research survey corrupts their data, and a required question is usually required because the answer matters.

Written by , developer and writer.

Last reviewed