🔍 Homoglyph Detector
Detect homoglyph and mixed-alphabet characters in domains and text to spot phishing and spoofing attacks. Shows confusable Unicode characters with their codepoints and meanings.
| Char | Position | Unicode | Block | Resembles |
|---|
About this tool
Homoglyph attacks use characters that look identical to Latin letters but come from other alphabets — most commonly Cyrillic, Greek, or Armenian. A domain like раypal.com contains Cyrillic а (U+0430) and р (U+0440) that are visually indistinguishable from Latin a and p, and would fool most users at a glance.
Example: раyрal.com → flags 2 homoglyphs: U+0440 Cyrillic Small Er (looks like 'p') and U+0430 Cyrillic Small A (looks like 'a'). The true domain is a lookalike, not the real PayPal.
This tool also detects invisible characters such as zero-width spaces, bidirectional markers, and zero-width joiners — all used in more sophisticated attacks to hide suffixes or alter the visual order of text. Paste a domain, URL, or any text for a full analysis.
FAQ
What are homoglyphs? ›
Homoglyphs are characters from different writing systems that look visually identical or nearly identical. For example, the Latin "a" (U+0061) and the Cyrillic "а" (U+0430) render identically in most fonts but are completely different Unicode code points. Attackers exploit this to register domains that look like trusted brands.
How is this different from Punycode? ›
Punycode is the encoding that converts Unicode domain names to ASCII for DNS — for example, café.com becomes xn--caf-dma.com. Homoglyph detection identifies which specific characters are suspicious; Punycode is what the DNS system actually uses. In an attack, the Punycode form (e.g. xn--raypal-lwe.com) reveals the spoofed domain structure. Use the <a href="/tools/punycode-converter" class="text-accent underline">Punycode Converter</a> for general-purpose IDN encoding/decoding.
What do invisible characters mean? ›
Characters like Zero-Width Space (ZWSP, U+200B) or Right-to-Left Override (RLO, U+202E) are invisible but alter text rendering. Attackers insert them into domains or URLs to hide suffixes or reverse parts of the text. The tool flags them as HIGH risk because they have no legitimate use in domain names.
Is every non-Latin character a risk? ›
No. Legitimate internationalized domain names use non-Latin scripts for real brands and organisations. The risk comes from mixing scripts — a Cyrillic character inside what otherwise looks like a Latin domain, for example. This tool flags each suspicious character individually so you can judge the context.