Developer · Unicode
Unicode confusable & homograph detector.
Paste a username, domain label or identifier to see which characters have lookalikes, whether it mixes scripts, and what its UTS #39 skeleton is. Add a second string to test whether the two can be confused. Runs in your browser; nothing is sent anywhere.
Input
Loading confusables data…
Result
Enter a string and press Analyse.
Worked example
The string pаypal looks like paypal, but its second letter is U+0430 CYRILLIC SMALL LETTER A, not U+0061. The tool reports two scripts (Latin and Cyrillic), flags the string as mixed-script, lists U+0430 as mapping to a, and shows the skeleton paypal. Compared with the real paypal, the two strings are different text with identical skeletons, so they are confusable.
How the skeleton is computed
UTS #39 defines skeleton(X) in four steps: convert to NFD; remove characters with the Default_Ignorable_Code_Point property (zero-width characters, for example); replace each character with its prototype from confusables.txt, leaving it alone if it has no entry; convert to NFD again. Two strings are confusable when their skeletons are equal. The prototype is a canonical stand-in, not necessarily the letter you would expect, so a skeleton is for comparing, not for display. For example, m has the skeleton rn, because the data treats the pair rn as a lookalike of m.
Mixed-script detection
Each character is looked up by its Unicode Script_Extensions value. Digits, punctuation and combining marks are ignored. A string is flagged when no single script fits every remaining character. Han with Hiragana and Katakana (Japanese), Han with Hangul (Korean), and Han with Bopomofo are allowed combinations, as in UTS #39 section 5.1. The tool recognises 42 common scripts; a character from any other script is shown as “Other”.
Data and as-of date
The mapping is a trimmed copy of confusables.txt from Unicode 18.0.0, file dated 2026-08-06, with 6,712 source characters, taken from unicode.org/Public/security/latest/confusables.txt. The page shows the version loaded. Unicode revises the file with each release, so a newer release may add or change entries.
What this does not do
It does not reorder right-to-left text (the bidiSkeleton step), does not apply the identifier-status restrictions of UTS #39, and does not know how your fonts draw a character. It only knows the pairs in the data, so lookalikes that are not listed are not found, and it cannot tell you which real name a string is imitating. In the data the digit 1 and the letter l share a skeleton, so paypa1 and paypal compare as confusable.
Sources: Unicode confusables.txt; Unicode UTS #39, Unicode Security Mechanisms.
Frequently asked questions
Why does an ordinary word get flagged?
The data lists lookalikes of many everyday characters, including the digit 1, the letters l and I, and the letter m. A skeleton difference only means the string contains a character that has a lookalike, not that anything is wrong. Mixed-script is the stronger signal; confusable characters inside a single script are usually harmless.
Why was nothing flagged when two strings looked the same?
The skeletons only match when every difference is covered by the data. Characters can look alike in your font without being listed, and some lookalikes are listed only in one direction through a shared prototype.
Are real names in other languages false positives?
Often. A Greek name written entirely in Greek is one script and is not flagged as mixed, but its letters may still have Latin lookalikes in the data. Mixed Latin and Cyrillic text is legitimate in some languages and in brand names.
Does the tool send my text anywhere?
No. The data file is downloaded once and all analysis runs in your browser.
No security guarantee
This tool reports what the Unicode confusables data and script properties say about a string. A clean result does not mean a name is safe, and a flag does not mean it is malicious. It is not a substitute for a registry policy, a browser’s own IDN display rules, or a security review.