The Hidden attribute in legacy Word

How the text is hidden

Character formatting in a .doc is stored as CHPX property runs, reached through the PlcfBteChpx bin table: the bin table names 512-byte FKP pages, and each page holds byte ranges with a packed property list (grpprl) for each. The Hidden attribute is the SPRM sprmCFVanish, opcode 0x083c, a one-byte toggle. Setting it on a run tells Word not to draw that run; the characters stay in the text stream and the piece table still addresses them.

Why a model still reads it

Hiding is a display property attached to a range of characters, not a removal. The bytes remain in the WordDocument stream in reading order, so any extractor that walks the piece table without reading the CHPX bin table returns hidden and visible text indistinguishably.

What we do about it

readChpxRanges reads the pages the bin table NAMES rather than scanning for pages that look like FKPs, and readSprms walks each property list by the operand size encoded in the opcode, so unknown properties are skipped by length rather than guessed at. Opcode 0x083c sets hidden on any non-zero value — the toggle values meaning "inherit" and "invert" resolve to hidden rather than visible, because reporting a hidden run as visible is the wrong direction to fail. A run with hidden set gets invisibleReason: 'hidden-attr', which visibilityOf classifies as editing-only — Word's "show hidden text" is a checkbox in Options. The rule doc-hidden-text fires at severity high with action strip, so the text is removed from text.canonical.

How often it fires

3.3% of GovDocs1 legacy .doc — real government correspondence and reports, measured 2026-08-21.

This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.