Will cleaning a URL remove percent-encoded hidden characters?

Measured inputs and outputs

These are locally constructed test strings, not evidence that Claude inserts these characters. We executed the saved homepage script snapshot with a minimal DOM harness and compared exact strings. Invisible removal is enabled; the dash mode appears in each row. The observations below test this page's specific question. We make no detector-score or statistical-watermark removal claim.

The route distinction in our fixtures

The literal path and percent-encoded path serialize to the same encoded pathname before cleanup. Our homepage deletes the actual character from the first input, so that output parses with /review as its path. The encoded input contains ordinary ASCII percent signs, hex digits and letters; none belongs to the deletion map. Its decoded path still contains U+200B after cleaning. The clean reference stays unchanged. These measurements separate a text transformation from the subsequent URL parser and percent decoder.

A URL parser is not a route validator

The test uses the WHATWG URL implementation in the recorded Node runtime and a reserved example.test host. It makes no HTTP request to that host. A parseable URL can point at a nonexistent route, and a server can treat an encoded path differently from its decoded representation. We have not tested your router, redirects, reverse proxy or signed URL verification. The evidence establishes the exact strings at each stage; it does not establish that either spelling reaches the intended resource.

Repair a link with its destination in view

Keep the original link, inspect its parsed pathname and compare it with a known destination. If an accidental code point is present, change only the intended path component and rebuild the URL with a URL API. Do not decode the entire URL and then delete characters: escaped delimiters may become structural delimiters. Check query values and fragments separately, and verify the final link in its actual application. The homepage cleaner neither percent-decodes URLs nor chooses routes.

Reproduce this test

Save reproduce.cjs and tested-app.js in the same folder. Run the command below with Node.js. The harness prints its runtime, script SHA-256 and every measured row. Compare those rows with the original record. Using a newer script or runtime creates a new experiment; retain the version information with your rerun.

node reproduce.cjs