Unicode & Homoglyph Check API

Inspect text character by character (code points, scripts, invisible and bidi characters) and detect look-alike domains such as аpple.com written with Cyrillic letters.

GETPOSThttps://apibox.io.vn/v1/unicode-check

Security & Crypto▶ Try it online

The Unicode check API shows what is really inside a string. With text it lists every character with its code point, UTF-8 bytes, general category and script, and flags invisible characters (zero-width spaces, soft hyphens, BOM, no-break spaces) and the bidirectional overrides used in “Trojan Source” attacks. It also gives lengths in code points, UTF-16 units, bytes and user-perceived characters, and whether the text is NFC or NFD (useful for Vietnamese text from macOS).

With domain it converts between Unicode and punycode (bücher.de ↔ xn--bcher-kva.de), lists the scripts of each label and the characters that look like Latin letters, and computes the “skeleton” the domain visually resembles. аpple.com (with a Cyrillic а) is reported as suspicious because it looks like apple.com but is a different domain, the classic IDN homograph phishing trick.

The look-alike table covers the Cyrillic, Greek, Cherokee and fullwidth characters most used for spoofing (a subset of Unicode’s confusables data).

Parameters

Name	In	Type	Required	Default
`text`	body\|query	string	no		Text to inspect (max 2,000 characters listed; `summary_only=true` for longer).
`domain`	body\|query	string	no		Domain to check (Unicode or punycode).

Example

curl "https://apibox.io.vn/v1/unicode-check?domain=аpple.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/unicode-check?domain=аpple.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/unicode-check?domain=аpple.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/unicode-check?domain=аpple.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "input": "аpple.com",
  "ascii": "xn--pple-43d.com",
  "unicode": "аpple.com",
  "is_idn": true,
  "labels": [
    {
      "label": "аpple",
      "scripts": [
        "Cyrillic",
        "Latin"
      ],
      "mixed_scripts": true,
      "confusable_chars": [
        {
          "char": "а",
          "codepoint": "U+0430",
          "script": "Cyrillic",
          "looks_like": "a"
        }
      ]
    },
    {
      "label": "com",
      "scripts": [
        "Latin"
      ],
      "mixed_scripts": false,
      "confusable_chars": []
    }
  ],
  "skeleton": "apple.com",
  "looks_like": "apple.com",
  "suspicious": true,
  "note": "This domain mixes scripts or uses look-alike characters: it renders like \"apple.com\" but is a different domain."
}

Use cases

Block look-alike usernames and domains at sign-up
Phishing checks on links in emails and chats
Find invisible characters breaking imports or comparisons
Debug encoding problems in Vietnamese text

FAQ

What is an IDN homograph attack?

Registering a domain with characters from another script that look identical, e.g. Cyrillic а instead of Latin a, to impersonate a known site.

Why is my Vietnamese text not NFC?

Text from macOS files or some keyboards uses decomposed characters (NFD). It looks the same but compares differently; normalise it with the NFC form returned.

Does it use the full Unicode confusables list?

A curated subset of the characters actually used for spoofing Latin letters, to keep it fast and avoid false positives in legitimate non-Latin text.

Unicode & Homoglyph Check API

Parameters

Example

Response

Use cases

FAQ

Related APIs

Hash Generator

Encode / Decode

Password Generator