Loading Homoglyph & Lookalike Detector…
Everything below happens in this tab. No name is looked up and nothing is sent anywhere — the string is examined as text, which is the only safe way to examine a domain somebody else chose.
Paste something above. Nothing is examined until you do.
Lookalike mappings are 691 entries taken from the Unicode Consortium’s UTS #39 confusables.txt, version 17.0.0, dated 2025-07-22, filtered to the ones that imitate a single ASCII character. The 194 invisible and blank characters come from UnicodeData.txt by general category, and block names from Blocks-17.0.0.txt, dated 2025-08-01 — 346 blocks in all. Data retrieved 2026-08-17. Punycode follows RFC 3492 and the four label separators RFC 3490 §3.1. None of it is typed from memory.
Cyrillic has a letter that renders as an identical glyph to the Latin a in every typeface you are likely to meet. Substitute it into a familiar brand name and you have a domain that reads correctly to a person and resolves somewhere else entirely, because a name server compares bytes and never looks at shapes. The same trick works with Greek omicron for o, Cyrillic es for c, and several hundred other pairs.
Paste a string here and every character outside plain ASCII is listed with its code point, its Unicode name, the block it belongs to and the ASCII character it imitates. The tool then shows what the whole string reduces to once each impostor is replaced by the letter it copies, which is the quickest way to see that two names a person would call identical are nothing of the sort.
Lookalikes have a quieter cousin: characters that occupy a position in a string and draw no ink. Zero-width joiners, soft hyphens, byte order marks and the Hangul filler all pass through copy and paste, survive most form validation, and change what a comparison sees while changing nothing a reader sees. A username with one in the middle is a different username; a password with one at the end is a different password.
Bidirectional controls deserve their own heading, because they do something stranger. They reorder the characters that follow them at display time, so a filename can present as a document and execute as a program, and a line of source code can read one way to a reviewer and compile another way. Those are separated out here rather than lumped in with the invisible characters, since the consequence is different.
The lookalike table is not a list somebody typed from memory. It is generated from the Unicode Consortium’s own confusables data, filtered to the mappings where a single non-ASCII character imitates a single printable ASCII one, with the file version and date recorded in the tool. Character names and the invisible set come from the character database by general category, and block names from the block file.
One family is deliberately excluded. Bold, italic, fraktur and circled letters appear in the source data as confusable, and they are not lookalikes in the sense that matters here: a reader can see that they are different, and no domain name may contain them. Leaving them in would inflate the count and dilute the finding that matters.
Non-ASCII names travel as an ASCII encoding beginning xn--, and browsers decide for themselves whether to display the decoded form or the encoded one. The rules turn on whether a label mixes writing systems in a suspicious combination and whether it matches the language settings in use, which is why the same address can appear one way to you and another to a colleague abroad.
Those rules cover mixed labels well and whole-script imitation poorly. A name written entirely in one non-Latin script that happens to spell a familiar Latin word is consistent by every measure a browser applies, and will be shown decoded and unremarkable. That case is why reading the encoded form of an unfamiliar link is still worth the four seconds it takes.
No. Most of the world writes its names in something other than the Latin alphabet, and internationalised domains exist so it can. What deserves a second look is a single foreign character sitting inside an otherwise Latin word, which is a combination nobody chooses by accident.
That is the browser declining to display the decoded form because the label failed its checks — usually by mixing scripts. Seeing the encoded version is the warning working, not a rendering fault, and it is worth reading before you continue.
Yes. Usernames, filenames, package names, commit messages and pasted code are all worth checking, since anywhere two strings are compared for equality is somewhere an invisible character can hide. The tool treats whatever you paste as text.
It means nothing in the string is imitating something else. A perfectly ordinary ASCII domain registered five minutes ago to send phishing will pass this check cleanly, because the characters are exactly what they appear to be.