Toolgeist › Security

Homoglyph & IDN Spoof Detector — Check for Lookalike Unicode Characters

Paste a domain, URL, username, email address or a line of code and find out whether it is pretending to be something else. The checker follows Unicode’s own security standard, UTS #39, using the Unicode Consortium’s confusables data: it spots letters from other alphabets that look like Latin ones, words written entirely in another alphabet that read as a familiar name, invisible characters such as zero-width spaces, direction-control characters used in “Trojan Source” attacks on code, and fullwidth or stylised compatibility characters. For domains it also shows the punycode address your browser really connects to. It correctly catches the famous 2017 “аррӏе.com” spoof — all Cyrillic, so it evaded the mixed-alphabet checks browsers relied on — while leaving ordinary text in Greek, Russian, Chinese, Japanese or accented Latin alone.

How to use Homoglyph & IDN Spoof Detector — Lookalike Unicode Checker

  1. Paste a domain, link, username, email or line of code — or load one of the examples.
  2. Read the verdict and each finding, from lookalike letters to hidden characters.
  3. For a domain, compare the displayed name with the real punycode address.
  4. Use "Compare two strings" to test whether two names can be mistaken for each other.

Frequently asked questions

What is a homoglyph or IDN homograph attack?
Registering or displaying a name made of characters that look like the real thing but are different code points — for example a Cyrillic "а" in place of a Latin "a". The domain looks right in the address bar but belongs to someone else. Internationalised domain names (IDNs) make this possible because domains can contain letters from any alphabet.
Why is checking for mixed alphabets not enough?
Because a spoof can use one alphabet throughout. In 2017 a researcher showed "аррӏе.com" — every letter Cyrillic — displayed as apple.com in several browsers. A mixed-script check sees a single script and stays silent; this tool also maps every character to what it resembles, so it reads that domain as "apple" and flags it.
What is Trojan Source?
A technique that hides Unicode bidirectional control characters in source code so the order text is displayed differs from the order the compiler reads it. A comment can appear to end before it really does, so a reviewer approves code that behaves differently. The tool names each direction-control character it finds.
How does it decide two strings are confusable?
It computes each string’s "skeleton" as defined in UTS #39: normalise, remove invisible characters, replace every character with the prototype it is most easily confused with, and normalise again. Two strings are confusable exactly when their skeletons are identical — so "paypa1" and "paypal", or "rnodern" and "modern", are confusable, while "apple" and "apples" are not.
Will it flag normal non-English text?
No. Text in a single script — Greek, Russian, Chinese, Arabic, German with umlauts — is normal, and so is the Latin-plus-Chinese/Japanese/Korean mixing that the Unicode standard classes as highly restrictive. Warnings are reserved for mixes like Latin with Cyrillic, lookalike readings, hidden characters and direction controls.
Is a clean result a guarantee?
No. It means none of these Unicode spoofing signals were found. A domain can be malicious with perfectly ordinary letters, and a flagged string is a reason to look closer, not proof of intent. Nothing you paste leaves your browser.

Related Security tools

Also searched for: homoglyph detector · idn homograph checker · punycode domain checker · unicode lookalike character checker · trojan source bidi character detector

Browse all 738 free tools on Toolgeist →