Homoglyph Detector
Find lookalike Unicode characters, mixed-script spoofing and invisible zero-width characters hiding in any text.
Where the suspicious characters are
Tap a highlighted character to jump to its entry in the findings below.
Findings
ASCII skeleton
What is a skeleton?
The skeleton is what the text collapses to once every lookalike is mapped to its ASCII twin, invisible characters are dropped and accents are removed. Two strings with the same skeleton are confusable.
Common lookalikes to watch for
ะฐU+0430 Cyrillic small letter a, identical to LatinaะพU+043E Cyrillic small letter o, identical to LatinoัU+0440 Cyrillic small letter er, identical to LatinpฮฟU+03BF Greek small letter omicron, identical to LatinoัU+0455 Cyrillic small letter dze, identical to LatinsษกU+0261 Latin small letter script g, identical togใU+3002 ideographic full stop, treated as a domain dot by browsersU+200Bzero width space, splits a word without showing anythingU+202Eright-to-left override, reverses the text that follows it
How it works
A homoglyph is a character from one writing system drawn the same as a character from
another: the Cyrillic ะฐ (U+0430) and the Latin a (U+0061) are
pixel for pixel identical in most fonts, yet they are different characters, so
pะฐypal.com and paypal.com are different domains. That is the trick
behind IDN homograph phishing, fake usernames, spoofed package names and typosquatting that
contains no typo at all. This detector walks your text one code point at a time, labels the
Unicode script of each character (Unicode Standard Annex #24), flags any character that is a
known confusable of an ASCII one, and applies the single-script check from
Unicode Technical Standard #39, Unicode Security Mechanisms: a word that
mixes two scripts, Latin plus Cyrillic for example, is reported as mixed-script spoofing.
The genuinely multi-script combinations UTS #39 allows (Japanese, Korean and Chinese text
mixing Han with Hiragana, Katakana, Hangul or Bopomofo alongside Latin) are not flagged.
It also flags invisible characters: zero-width spaces and joiners, the byte-order mark, soft hyphens, and the bidirectional overrides behind Trojan Source attacks, where U+202E makes a line of code render in an order different from the one the compiler reads. Unusual whitespace such as the no-break space U+00A0 is reported separately, because it survives a copy-paste and then breaks a lookup that expects a plain U+0020. The ASCII skeleton follows the same idea as the UTS #39 skeleton function: map every confusable to its ASCII twin, drop the invisibles, strip accents. If two strings share a skeleton they can be mistaken for each other, which is what the comparison box checks. The confusable table here is a curated subset of the official confusables data, not the whole file, so treat a clean result as "nothing obvious" rather than a formal guarantee. Everything runs in your browser with no network requests, so it is safe to paste a suspicious email, domain or code snippet.
Frequently asked questions
What is a homoglyph attack?
A homoglyph is a character from one writing system drawn the same as a character from another. The Cyrillic a (U+0430) and the Latin a (U+0061) look identical in almost every font, so an attacker can register a domain, username or package name that reads as paypal.com while being a completely different string. Because the two names are different to a computer but the same to a human, links, allowlists and eyeballs all fail to catch it. This is also called an IDN homograph attack when it happens in a domain name.
How do I check a domain or username for fake lookalike characters?
Paste it into the box and the check runs as you type. Every character is labelled with its Unicode code point, its official name and its script, any known confusable of an ASCII character is flagged, and the single-script check from Unicode Technical Standard #39 reports words that mix two scripts such as Latin plus Cyrillic. Paste the real name into the comparison box and the tool tells you whether the two strings share a skeleton, which means they can be mistaken for each other.
Why do zero-width and invisible characters matter?
A zero-width space, a joiner or a byte-order mark takes up no visual space but still changes the string, so two names that look identical can compare as different, pass a duplicate check they should have failed, or slip past a keyword filter. Bidirectional controls are worse: a right-to-left override (U+202E) makes text render in an order different from the one a compiler or shell reads, which is the basis of Trojan Source attacks in source code. The detector lists each of these by code point so you can see exactly what is hiding in the text.