Homoglyph and invisible character inspector
Expose the Cyrillic a, the zero-width space and the Punycode behind a lookalike domain.
Nothing leaves your browser. This tool does its work on your own machine — there is no upload, no server request, and nothing is stored.
Two different tricks, one tool
Characters that look like other characters
Unicode contains many letters that render identically to Latin ones. The Cyrillic а (U+0430) and the Latin a (U+0061) are drawn the same in nearly every font, but they are different characters, so they make different domain names. Register the lookalike, get a certificate for it — certificates are free and automatic — and you have a site that is visually indistinguishable from a real one, padlock included.
Browsers defend against this by showing the Punycode form (xn--…) when a domain mixes scripts suspiciously. The defence is imperfect and depends on which browser you use, which is why checking a domain directly is worth the ten seconds.
Characters you cannot see at all
Zero-width spaces, joiners, soft hyphens and bidirectional overrides render as nothing. They are used to split a word so a filter matching on it fails, to hide a marker inside text that identifies who leaked it, and in the case of the right-to-left override, to make a filename display backwards — turning exe.pdf into something that reads as a PDF and runs as a program.
What to do when this finds something
- In a domain: do not visit it. Type the real address by hand or use a bookmark you already had. Then run the Punycode form shown here through the full check to see what is actually hosted there.
- In a message: hidden characters mean the text was constructed to get past something. Treat the message as hostile regardless of what it says.
- In your own text: if you pasted from a document and this finds soft hyphens or non-breaking spaces, that is ordinary word-processor residue, not an attack. The result page tells the two cases apart.
Common questions
What is a homoglyph attack?
Some letters in other alphabets are drawn identically to Latin ones. The Cyrillic а and the Latin a are separate characters that look the same, so аpple.com and apple.com are different domains that are indistinguishable on screen. Registering the lookalike is a standard phishing technique.
What is Punycode and why does it show xn--?
Domain names travel over the network as ASCII, so names with other characters are encoded into a form starting with xn--. Seeing xn-- in a domain that looked like plain English is a strong sign the name contains foreign characters chosen to deceive.
What are zero-width characters used for?
They are invisible. Attackers insert them to break up words a spam filter looks for, to hide text inside a copied message, or to make two strings that render identically compare as different.