Homoglyph Detector
Detect lookalike characters such as Cyrillic а in pаypal.com, invisible zero-width and bidirectional control characters, and mixed scripts in domains and usernames.
Free · No sign-up · Your inputs stay in your browser
Input
Detect lookalike characters (homoglyphs)
Output
4 of 5 suspicious
| Input | Scripts | Lookalikes and invisibles | Verdict |
|---|---|---|---|
| pаypal.com | Latin + Cyrillic | а U+0430 | looks like "paypal.com" |
| аpple.com | Cyrillic + Latin | а U+0430 | looks like "apple.com" |
| google.com | Latin | - | ok |
| admin@example.com | Latin + Other | U+200B | looks like "[email protected]" |
| microsоft-support.com | Latin + Cyrillic | о U+043E | looks like "microsoft-support.com" |
Cyrillic а and Latin a render identically, so pаypal.com can be a different domain from paypal.com; invisible characters such as the zero-width space and the right-to-left override change what a string is without changing how it looks. Unicode Technical Standard #39 defines the full confusables list; this checks the common Cyrillic and Greek lookalikes, full-width digits and invisible characters. Browsers show such domains as punycode (xn--) to defend against this.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Same pixels, different string
Cyrillic а (U+0430) and Latin a (U+0061) look identical in most fonts, so pаypal.com can be registered as a different domain from paypal.com and used for phishing. Usernames, package names and source code have the same problem; the Trojan Source research showed bidirectional controls hiding code from reviewers. Unicode Technical Standard 39 defines confusable detection.
Defences
Browsers show suspicious internationalised domains as punycode (xn--). For usernames, normalise with NFKC and reject mixed-script identifiers or map them to a skeleton before checking uniqueness.
