Detect homoglyphs, zero-width characters, and BiDi overrides used in phishing and supply-chain attacks. 100% client-side.
Homoglyphs are characters from different Unicode scripts that look identical or nearly identical to common ASCII characters. For example, the Cyrillic "а" (U+0430) is visually indistinguishable from the Latin "a" (U+0061). Attackers use these confusable characters to create phishing domains, forge email addresses, and disguise malicious filenames that appear legitimate to humans.
Unicode defines over 149,000 characters across 161 scripts. The Unicode Consortium maintains an official confusables.txt mapping that identifies visually similar character pairs, which this tool uses for detection.
| Attack type | Technique | Example |
|---|---|---|
| IDN homograph | Cyrillic/Greek chars in domain | аpple.com (Cyrillic "а") |
| Zero-width injection | Invisible chars in filenames | invoice[ZWJ].exe looks like .pdf |
| BiDi override | RTL override reverses text display | file[RLO]fdp.exe displays as fileexe.pdf |
| Source code trojan | BiDi chars in code comments | Logic appears different than execution |
p=reject to prevent spoofed emails. Check your setup with our email security checker.No. All analysis runs entirely in your browser using JavaScript. The confusables database is loaded client-side and no network requests are made with your input data.
BiDi (Bidirectional) override characters like U+202E (Right-to-Left Override) force text to render in reverse order. Attackers insert these in filenames so that "photo[RLO]fdp.exe" displays as "photoexe.pdf", tricking users into executing malware. This technique also works in source code to make logic appear different from what actually executes.
Modern browsers display internationalized domain names (IDN) in Punycode (e.g., xn--pple-43d.com) when they detect mixed scripts, which mitigates pure homoglyph attacks. However, single-script attacks (using only Cyrillic, for example) may still display as the intended lookalike in some browsers.