Confusable / Homoglyph Checker
Check a user name, domain, URL or identifier for look-alike characters such as Cyrillic а in “pаypal”. Shows each character's script, what it looks like, mixed-script words and the Punycode form of a domain. Compare two strings to see whether they can be confused, using the skeleton from Unicode's official confusables data (UTS #39). Runs in your browser.
What is the Confusable / Homoglyph Checker?
Many characters from different scripts look the same: Latin a and Cyrillic а (U+0430), Latin o, Greek ο and the digit 0, or rn and m. Attackers use these homoglyphs to make phishing domains (IDN homograph attacks), fake user names and source code that looks harmless. This tool shows which characters in a string are not what they seem.
How to use
- Type or paste a user name, domain, URL or identifier into Text to check.
- The summary shows the scripts used and the restriction level. A word that mixes scripts, such as Latin and Cyrillic, is flagged.
- The colored view and the table show every character with its code point, script and what it looks like (its prototype). Characters that look like ASCII but are not are highlighted in red; other non-ASCII characters in amber; invisible characters are shown as
[U+XXXX]. - If the input looks like a domain or URL, the Punycode (ASCII) form of the host name is shown. If it already contains
xn--labels, the decoded Unicode form is shown. - To check whether two strings can be mistaken for each other, type the second one into Compare with. If both have the same skeleton, they are confusable.
Skeleton and confusables.txt
Unicode Technical Standard #39 (Unicode Security Mechanisms) defines the skeleton of a string: convert it to NFD, drop default-ignorable characters such as zero-width spaces, replace every character with its prototype from confusables.txt, and convert to NFD again. Two strings are confusable when their skeletons are equal. For example, pаypal (with Cyrillic а) and paypal both have the skeleton paypal, and m has the skeleton rn.
The skeleton is for comparing, not for display: it maps 1 to l and 0 to O, so it can look odd.
Restriction levels
| Level | Meaning |
|---|---|
| ASCII-Only | Only ASCII characters |
| Single Script | All letters are from one script (digits and punctuation are allowed with any script) |
| Highly Restrictive | Latin mixed with Japanese (Han, Hiragana, Katakana), Chinese (Han, Bopomofo) or Korean (Han, Hangul) |
| Moderately Restrictive | Latin mixed with one other common script except Cyrillic and Greek |
| Minimally Restrictive | Any other mix, for example Latin with Cyrillic or Greek. This is what spoofed names usually look like |
Levels are computed per word (the text is split at spaces and at URL separators such as ., /, @, :) and for the whole input. The script of each character comes from the browser's Unicode data (\p{Script} and \p{Script_Extensions}), so a very new script can show as Unknown in an older browser.
Data and license
The confusables data is confusables.txt from Unicode 17.0.0 (https://www.unicode.org/Public/17.0.0/security/confusables.txt), 6,565 mappings. It is downloaded with the tool (about 48 KB) only when you open it.
Unicode data: Copyright © 1991–2025 Unicode, Inc. Distributed under the Unicode License v3 (https://www.unicode.org/license.txt). Unicode and the Unicode Logo are registered trademarks of Unicode, Inc. in the U.S. and other countries.
FAQ
Does “Single Script” mean the string is safe?
No. A whole word in Cyrillic, such as аррӏе (xn--80ak6aa92e), is single-script but looks exactly like apple. Check the Looks like column and compare the string with the name it might imitate.
Why are digits like 1 and 0 shown as looking like l and O?
Those are real confusions listed in confusables.txt. They are shown in the table but not highlighted, because they are ASCII.
Is the domain looked up or opened?
No. Nothing is opened or sent anywhere. The Punycode form is computed by the browser's URL parser, and links are never created from your input.
Can this tool also find zero-width spaces?
It shows invisible characters as [U+XXXX]. To list and remove them, use the Invisible Character Detector & Remover.