Lookalike Characters

What it's for

Many letters in other alphabets look exactly like Latin ones: Cyrillic а, е, о, р and с, Greek ο and ν, and others. A web address, user name or file name written with them looks right but goes somewhere else, which is called a homograph attack. This finds those letters, words that mix alphabets, and invisible and text-direction characters, and shows what the text really is.

For example, when a link in an email reads pаypal.com and you’re not sure, paste it here: it’s flagged because pаypal mixes Latin and Cyrillic letters, and you see the xn-- address the browser would actually go to.

How to use it

Paste a link, domain, user name or any text. As you type, it’s shown with each suspicious character marked (hover over one for its code point), and below that:

• A list of problems: words that mix alphabets, words written entirely in lookalike letters of another alphabet (аррӏе), lookalikes beside Latin text, invisible characters and text-direction controls, worst first. Accented letters are a note, as they’re normal in many languages.
• Reads as: the text with every lookalike swapped for the letter it passes for, invisible characters removed, and full-width and maths letters (ｐａｙ, 𝐩𝐚𝐲) made plain.
• For a web address with any non-Latin letters, the punycode form (xn--…) the browser actually uses, and the other way round: a pasted xn-- address is turned back into its letters and checked.
• A table of each suspicious character: its code point, alphabet (script), what it looks like and why it’s listed.

Fill in Compare with to check whether two texts are the same, or only look the same; that also catches plain lookalikes such as rn for m and 1 for l. Copy a link to this input keeps both texts.

Example

Choose Try an example, which types this:

https://xn--80ak6aa92e.com/login

It’s decoded to аррӏе.com, flagged as all Cyrillic letters that look Latin, and reads as apple.com. Compared with https://apple.com/login, it looks alike but is made of different characters.

Good to know

The lookalikes are the common ones from Unicode’s confusables list, not all of its several thousand, and fonts differ in which letters look alike. Text written in one alphabet (a Russian word in Cyrillic) isn’t flagged unless it would pass for a Latin word. A clean result doesn’t make a link safe: paypal-secure-login.com uses only plain letters. Nothing you paste leaves the page.