A non-breaking space is a whitespace character that prevents an automatic line break at that point. It is used in text and HTML to keep related words, numbers or symbols together, and in markup it can affect layout without changing the visible content.
How a non-breaking space works
A non-breaking space is a whitespace character that preserves separation while preventing an automatic line break at that position. In plain text and HTML, it behaves like a normal visible space to the reader, but it changes how layout engines wrap lines.
This makes it useful when two items should stay together as a single visual unit, such as an abbreviation and a number, a name and title, or a symbol and its value. The character affects formatting, not meaning, so the underlying content remains the same.
Where it matters in web content
In markup, non-breaking spaces are often used to control line flow in headings, labels, navigation, price strings and other short text fragments where a wrap would create awkward spacing or reduce readability. It is a formatting tool, not a semantic one.
That distinction matters because overuse can make content harder to maintain and can interfere with responsive layouts if authors rely on manual spacing instead of the document structure and CSS. Good use is precise and limited to cases where keeping text together is materially helpful.
Common representations and implementation detail
HTML exposes non-breaking space through character references such as the nbsp character reference, while many editors and code paths also provide a keyboard or entity-based way to insert it. The practical result is the same, a space that does not permit wrapping at that point.
Because different rendering environments can normalise, collapse or preserve whitespace differently, authors should treat the character as a layout control with specific browser behaviour, not as a substitute for careful content structure. Its effect is visible most clearly when line length is constrained.
Why it is easy to misuse
Non-breaking spaces are often introduced to solve a local formatting problem, but they can accumulate into brittle text that is difficult to edit, translate or restyle. They also make it harder to understand whether spacing comes from content or presentation, which can complicate maintenance.
For that reason, they are best reserved for genuine no-wrap relationships rather than used as a general spacing technique. If the layout requirement is broad, CSS usually provides a cleaner and more durable approach.
Risk and Threat Considerations
Non-breaking space is not a security control, but it can still create operational risk when used carelessly in user-facing content, configuration text, or data copied between systems. The main issue is not exploitation, it is content integrity, rendering inconsistency, and the possibility that a visually subtle spacing character changes how text is parsed or displayed.
Failure mechanism: Hidden or unexpected whitespace can cause display defects, copy-and-paste errors, template drift, or string-matching failures when applications compare text, generate reports, or validate user input.
Impact: The result can be broken formatting, misleading text, failed automation, or hard-to-diagnose inconsistencies between what users see and what systems store or process.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-16 — Application Software Security | Whitespace handling affects content integrity and text processing reliability. |
| Recommendation — Review content handling to prevent formatting characters from breaking validation, parsing, or user-facing output. | ||
Practitioner Guidance
Why practitioners should care: Non-breaking space is a small formatting detail, but it can have outsized effects in content pipelines, localisation, and systems that depend on exact string handling. Teams should treat it as a deliberate formatting choice, not an invisible convenience.
What to watch for: Check whether the character is being used to fix a layout issue that should instead be solved with structure, styling, or content redesign. If it appears repeatedly in templates or data feeds, it may indicate a maintenance problem rather than a one-off formatting need.
Related resources from NHI Mgmt Group
- How should teams certify non-human identity access without breaking production?
- How should security teams handle risky behaviour from non-human identities without breaking production?
- How should organisations offboard non-human identities when an employee leaves without breaking critical workflows?
- How should teams adopt non-mutating array methods without breaking existing JavaScript code?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org