Line, Word & Character Counter

A quick, private way to measure text: this counter reports the number of characters (with and without spaces), words, and lines for whatever you paste. Everything runs locally, so you can measure sensitive or unpublished text without it leaving your browser.

How you'll use it. Check a message against a length limit — a tweet, an SMS segment, a meta description, a database column, an API field — before you submit it. Count lines in a log excerpt or a wordlist. Verify that a payload fits within a size constraint. The character-count-without-spaces figure is handy when a limit counts visible characters differently from raw length. A few concrete limits worth memorising: an SMS segment is 160 GSM-7 characters (70 if any Unicode forces UCS-2), a search-result meta description is usefully around 150–160 characters, and a classic VARCHAR(255) column stores 255 bytes in many databases, not 255 characters.

How counting is defined here. Words are runs of non-whitespace separated by whitespace, so multiple spaces do not inflate the count. Lines are counted by line breaks, and characters use the string's length. These are the conventions most "character limit" systems use, but be aware that definitions vary — some platforms count a trailing newline, some count graphemes rather than code units.

A note on characters vs bytes. Length in characters is not the same as length in bytes, and this trips people up constantly. A UTF-8 emoji or accented letter is one visible character but several bytes, and in JavaScript's UTF-16 an emoji can even be two code units. If a limit is expressed in bytes (many database columns, some protocols), a string that looks short can still overflow. When the constraint is bytes, encode to UTF-8 first and measure that — the hex converter shows the exact byte sequence a string expands to.

Defensive angle. Length limits are a genuine security control, not just a UX nicety. Unbounded input is the entry point for buffer-style overflows in native code, resource-exhaustion denial of service, oversized-payload attacks, and log-flooding. Always enforce a maximum length on untrusted input server-side, measured in the unit your storage actually uses (bytes for byte-limited fields), and reject anything over the bound before processing it.