セキュリティ

ゼロ幅非接合子 (ZWNJ)

U+200C。隣接する文字の結合を防ぎます。ペルシャ語/アラビア語で正しい文字形態のために必須で、デーヴァナーガリーで合字を防ぐためにも使われます。

· 更新日

What is ZWNJ (Zero Width Non-Joiner)?

ZWNJ stands for Zero Width Non-Joiner, encoded at U+200C. Like its counterpart ZWJ (Zero Width Joiner, U+200D), ZWNJ is an invisible formatting character with zero visual width. Where ZWJ instructs rendering engines to join or ligate adjacent characters, ZWNJ does the opposite: it prevents joining, ligature formation, or cursive connection between characters that would otherwise be combined by default.

ZWNJ is primarily used in scripts that employ cursive or ligature-forming typography — most notably Arabic, Persian (Farsi), Urdu, Devanagari, and other Brahmic scripts — as well as in general typography for ligature control in Latin script.

How ZWNJ Works in Arabic and Persian

In Arabic script, most letters connect to their neighbors in a cursive flow, changing their shape based on position. Persian (Farsi) is written in Arabic script with a few additional characters. In both languages, there are grammatical and typographic situations where a word boundary or morpheme boundary should visually break the cursive connection, even though the characters are part of the same word.

For example, the Persian word می‌رود (miravad, "goes") is written with a ZWNJ between می and رود to show that these are two morphemes — a prefix and a verb — without inserting a full space. The ZWNJ breaks the cursive connection and creates a slight visual gap (a "half-space") while keeping the word as a single typographic unit for justification and line-breaking purposes. This usage is standard and required for correct Persian typography.

How ZWNJ Works in Devanagari and Brahmic Scripts

In Devanagari (used for Hindi, Sanskrit, Marathi, Nepali), ZWNJ prevents the formation of conjunct consonants. When two consonants appear together, the Devanagari rendering system normally forms a conjunct ligature — a combined glyph. Inserting ZWNJ between them preserves both consonants in their independent (virama-terminated) forms rather than combining them.

For example: क + ् + ष normally renders as the conjunct क्ष (ksha). Inserting ZWNJ (क + ् + ZWNJ + ष) renders as क् ष — the halant form of ka followed by independent sha.

ZWNJ in Latin Typography

In Latin script, ZWNJ can prevent automatic ligature formation. High-quality typography systems (TeX, OpenType) automatically ligate character pairs like fi, fl, ff, ffi, ffl. In some contexts — such as compound words in German where the ligature would cross a morpheme boundary — the ligature is typographically incorrect. ZWNJ inserted between the two letters prevents the ligature.

ZWNJ and ZWJ Comparison

Property ZWNJ (U+200C) ZWJ (U+200D)
Full name Zero Width Non-Joiner Zero Width Joiner
Effect on joining Prevents joining/ligature Encourages joining/ligature
Primary use Persian half-space, Devanagari conjunct prevention Emoji sequences, Arabic joining
Visual width Zero Zero
Unicode category Cf (Format) Cf (Format)

Security and Data Considerations

ZWNJ, like all invisible characters, can be used to insert hidden content into text. Two visually identical strings may differ because one contains ZWNJ characters. This matters for:

  • Password comparison: A password with embedded ZWNJ is technically different from one without
  • Text search: Search engines typically ignore ZWNJ for matching purposes
  • Data normalization: Applications processing user input should define a policy for stripping or preserving ZWNJ

Quick Facts

Property Value
Code point U+200C
Name ZERO WIDTH NON-JOINER
Unicode category Cf (Format character)
Visual width Zero — completely invisible
Primary script use Persian (Farsi), Arabic, Devanagari, Brahmic scripts
Persian function Half-space for morpheme boundary (می‌رود)
Latin use Prevents automatic fi/fl ligatures
Introduced Unicode 1.1 (1993)

関連用語

セキュリティ のその他の用語

Bidi Text Attack

Exploiting Unicode bidirectional control characters to disguise malicious code or filenames. The …

Bidi オーバーライド攻撃

Unicode双方向オーバーライド文字(U+202A〜U+202E・U+2066〜U+2069)を使って悪意のあるファイル名やコードを偽装する攻撃。'readme‮fdp.exe'は'readmeexe.pdf'と表示されます。

IDN ホモグラフ攻撃

ドメイン名に視覚的に似たUnicode文字を使って正規サイトになりすます攻撃。аpple.com(キリルа)はapple.comに見えます。ブラウザはPunycodeの表示ルールで防御します。

Normalization Attack

Exploiting Unicode normalization to bypass security filters. Input validated before normalization may …

Unicode スプーフィング

Unicode機能を使ってユーザーを欺くこと:偽ドメインのためのホモグリフ・偽ファイル拡張子のためのBidiオーバーライド・隠しテキストのための不可視文字。

ゼロ幅接合子 (ZWJ)

U+200D。隣接する文字の結合を要求します。絵文字シーケンスに不可欠です(👩+ZWJ+💻=👩‍💻)。インド系文字では合字形成を要求します。テキスト境界を隠すためにも使われます。

ホモグリフ

異なるスクリプトから来た同一または非常に似て見える文字。例:ラテン'a'とキリル'а'。フィッシング・スプーフィング・ソーシャルエンジニアリング攻撃に使われます。

混同しやすい文字

confusables.txt(UCD)で定義された、視覚的に混同しやすい文字ペアに対するUnicodeの公式用語。ホモグリフより広い概念で、単に似ているだけの文字も含みます。

混在スクリプト検出

異なるスクリプトの文字を混在させるテキストを識別します(例:ラテン+キリル)。ホモグリフ攻撃に対する主要な防御で、ブラウザはこれを使ってPunycode表示をトリガーします。