IDN Homograph Risk Analyzer
Enter a domain in Unicode or Punycode to see which scripts and characters it uses, whether any of them imitate Latin letters, and optionally how it compares with a name it might be mistaken for.
- Security intelligence
- Live check
- Free, no sign-up
- Results are not published
Run IDN Homograph Risk Analyzer
At a glance
- What it checks
- Check whether an international (Unicode or Punycode) domain name can be visually confused with another name: scripts, look-alike characters and invisible characters.
- Data source
- Unicode UTS #39 confusables data and UTS #46 IDNA processing (ICU), run locally.
- Freshness
- Calculated on request, nothing is looked up
- Limits
- A visual risk indicator only; it says nothing about who owns a domain or why it was registered. Methodology
- Cost
- Free, no account needed
Understanding the result
What a homograph is
Internationalised domain names (IDNs) let domains use any script — नेपाल.com, münchen.de or пример.рф. Some letters in different scripts look identical: Cyrillic “а” (U+0430) and Latin “a” (U+0061) are indistinguishable in most fonts. A name built from such letters can look exactly like another name while being a completely different domain. That visual effect is called a homograph.
The analyzer shows the Unicode and Punycode (xn--) forms, every non-ASCII character with its code point, name and script, and which characters are listed as confusable with Latin letters or digits in the Unicode confusables data.
How the risk level is decided
The rules follow Unicode Technical Standard #39 through the ICU library, and each label (the parts between dots) is judged separately:
- Low visual-confusion risk: each label uses one script, or an accepted combination such as the Japanese scripts. नेपाल.com is low risk: a Devanagari label with a Latin top-level domain is normal.
- Review carefully: a label mixes scripts or digit systems in a way browsers treat with caution.
- High visual-confusion risk: a label mixes Latin with look-alike letters from another script, a whole label in another script reads as a Latin word, or the input contained invisible characters.
Letters with marks, such as ü or ł, are shown for information but do not raise the level on their own.
Comparing with another name
Enter a reference name, such as your own brand’s domain, in the comparison field. The analyzer reports whether the two names are visually confusable according to the Unicode data, or similar after mapping look-alike characters, and lists the positions where the characters differ. Nothing is looked up online and nothing is stored.
What the result does not say
This is a visual risk indicator. It does not say that a domain is harmful, who registered it or why: many legitimate names in Cyrillic, Greek and other scripts contain letters that look like Latin ones. To learn more about a domain, check its registration with the RDAP lookup and its certificates with the Certificate Transparency Search. The IDN Converter converts between Unicode and Punycode.
Frequently asked questions
Why does my browser show xn-- instead of the Unicode name?
Browsers display the Punycode form when a name mixes scripts or could be mistaken for another name, as protection against homographs. Single-script names in a script the browser considers safe are usually shown in Unicode.
Is a high risk level proof of phishing?
No. It only means the name can be visually confused with another. Whether that matters depends on who owns the domain and how it is used, which character analysis cannot tell.
What are invisible characters?
Zero-width spaces, joiners and direction controls do not show on screen. IDNA removes them before the name is looked up, so text containing them looks like one name but leads to another. The analyzer lists their code points.
Does the analyzer check ASCII tricks such as “rn” for “m”?
Only through the comparison option, which counts character differences after look-alike mapping. Without a reference name there is nothing to compare an ASCII name with.