Also available in: Español · Português · Français · العربية
Lookalike Characters: Check Text for Homoglyphs
Which characters in your text are pretending to be Latin letters, what script they come from, and whether the usual defence would catch them.
What is a lookalike character?
A lookalike character — a homoglyph — is a character from one script that is drawn almost identically to a character from another. The Cyrillic а and the Latin a are different code points that most fonts render the same way. Put one inside a domain name and you have a web address that reads correctly and goes somewhere else.
Unicode publishes the authoritative list of these as confusables.txt, the data behind its security report UTS 39. That file is what registrars and browsers consult when deciding whether two names look too alike to both exist. Reduced to single characters standing in for a single Latin letter, it holds 1,277 impostors drawn from 43 scripts.
This page checks your text against that table, names every impostor it finds, and tells you the one thing most tools do not: whether the standard defence would have caught it.
How to use it
- Paste the text. A domain, a username, a package name, an email address — anything you are about to trust. It is checked in your browser and never uploaded.
- Read the verdict. You get the Latin spelling the text actually resolves to, and a plain statement of whether a mixed-script check would object to it.
- Then look at the table. Every impostor is listed with its position, its code point, its official Unicode name, the script it belongs to and the letter it imitates.
The attack is named after Cyrillic and mostly is not Cyrillic
Cyrillic contributes 43 of the 1,277 impostors and Greek another 38. The largest single source, by a wide margin, is the script Unicode calls Common: 823 of them. Common is where the mathematical alphanumerics live, along with fullwidth forms, enclosed letters and a good deal else that is not part of any alphabet.
That is not a curiosity, because of how the usual defence works. The cheap and near-universal check is to ask whether a string mixes scripts, on the reasoning that a genuine Latin word has no business containing a Cyrillic letter. Unicode treats Common as compatible with every script — mathematical symbols are supposed to appear alongside any language — so a mathematical bold a sitting in the middle of Latin text raises no mixed-script objection at all.
There is a second way past the same check, and it is the one the Cyrillic reputation comes from: spell the whole word in one script. A word written entirely in Cyrillic characters is perfectly consistent, so nothing is mixed, and the check has nothing to say. The tool reports both cases explicitly rather than leaving you to work out which one you are looking at.
Two letters nobody can fake with one character
Every Latin letter has at least one single-character impostor except two, and the reasons are different — both recorded in the file itself.
Capital I has none because it is not a target at all. Unicode folds capital I, lowercase l and the digit 1 onto a single representative, so the table maps I to l rather than the other way round: 79 characters point at lowercase l, and none point at capital I. Lowercase m has none because its impostor is not one character. The table maps m to rn, the two-letter sequence that has been fooling readers since long before Unicode existed.
So the two gaps in the list are precisely the two famous spoofs that work by a different mechanism. That is a pleasing result, and the generator that builds this dataset refuses to emit it if the finding ever stops holding.
What this page cannot tell you
It cannot tell you that text is malicious. A great many of these characters have entirely legitimate uses: mathematical alphanumerics belong in mathematics, fullwidth forms belong in Japanese typesetting, and a Cyrillic а in a Russian word is simply the letter a. What the page reports is that a character is not the Latin letter it resembles, which is a fact rather than an accusation.
It also does not check the reverse direction. Unicode records 2,103 characters whose lookalike is a sequence rather than a single character — m for rn is the famous one — and those are a different shape of problem that a per-character scan cannot see.
And it is only about appearance. Text can deceive in ways that have nothing to do with how characters are drawn, most obviously by hiding characters that render as nothing at all. That is a separate check, and there is a separate page on this site for it.
Why is it free?
The table is a few kilobytes shipped with the page, and the check runs in your browser. Nothing you paste is uploaded, nothing is logged, and there is no account to make.
No sign-up, no limits, and no watermark on anything you copy out.