Homoglyph & IDN Domain Checker

Inspect text character by character (code points, scripts, invisible and bidi characters) and detect look-alike domains such as аpple.com written with Cyrillic letters.

Result

Press “Run” to see the result.

The Unicode check API shows what is really inside a string. With text it lists every character with its code point, UTF-8 bytes, general category and script, and flags invisible characters (zero-width spaces, soft hyphens, BOM, no-break spaces) and the bidirectional overrides used in “Trojan Source” attacks. It also gives lengths in code points, UTF-16 units, bytes and user-perceived characters, and whether the text is NFC or NFD (useful for Vietnamese text from macOS).

With domain it converts between Unicode and punycode (bücher.de ↔ xn--bcher-kva.de), lists the scripts of each label and the characters that look like Latin letters, and computes the “skeleton” the domain visually resembles. аpple.com (with a Cyrillic а) is reported as suspicious because it looks like apple.com but is a different domain, the classic IDN homograph phishing trick.

The look-alike table covers the Cyrillic, Greek, Cherokee and fullwidth characters most used for spoofing (a subset of Unicode’s confusables data).

Use this in your code

curl "https://apibox.io.vn/v1/unicode-check?domain=аpple.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/unicode-check?domain=аpple.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/unicode-check?domain=аpple.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/unicode-check?domain=аpple.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

What is an IDN homograph attack?

Registering a domain with characters from another script that look identical, e.g. Cyrillic а instead of Latin a, to impersonate a known site.

Why is my Vietnamese text not NFC?

Text from macOS files or some keyboards uses decomposed characters (NFD). It looks the same but compares differently; normalise it with the NFC form returned.

Does it use the full Unicode confusables list?

A curated subset of the characters actually used for spoofing Latin letters, to keep it fast and avoid false positives in legitimate non-Latin text.