Loading page
About this tool
Detect invisible controls and deceptive look-alike characters.
The Hidden Unicode & Homograph Scanner walks pasted text one codepoint at a time and names every character that is invisible, deceptive, or borrowed from a script it does not belong to. It reports zero-width and formatting characters, control codes, private-use codepoints and unusual whitespace; it tracks whether bidirectional embeddings and isolates are balanced, which is the mechanism behind the Trojan Source attack (CVE-2021-42574); it decodes the hidden ASCII payload carried by U+E0000-block tag characters; and it applies UTS #39 mixed-script detection per word, folding look-alike letters to a Latin skeleton so you can read what a string is pretending to be. Hostnames are converted in both directions with the RFC 3492 Punycode algorithm. Everything runs in the browser and nothing is uploaded.
Open Hidden Unicode & Homograph Scanner on AltFTool — it loads instantly in your browser.
Paste into the box labelled 'Text to scan — a message, a URL, a filename, a diff hunk'; the page opens on a sample you can replace, or wipe with 'Clear' and restore with 'Reset to sample'.
Every codepoint is classified, bidirectional embeddings and isolates are checked for balance, U+E0020 to U+E007E tag characters are decoded back to the ASCII they spell, and each hostname label is converted with the RFC 3492 Bootstring algorithm.
Read 'What was found', 'Every flagged codepoint', 'Hostnames' with its 'A-label (wire form)' column and 'Words that are not what they look like', then take the fixed string with 'Copy cleaned text' or the whole write-up with 'Copy report'.
Each finding gives the real Unicode character name, its codepoint, its category, how many times it appears and the line and column of the first one.
Bootstring encode and decode are implemented in full, so an xn-- label is shown as it renders and a Unicode hostname is shown as it goes on the wire — matched against the RFC 3492 test vectors.
Every internationalised domain ends in an ASCII TLD, so a naive whole-name check flags all of them. Scripts are compared within each label, and a label written entirely in one non-Latin script that still reads as Latin is called out separately as a whole-script confusable.
Trojan Source (CVE-2021-42574) uses bidirectional control characters to make source code display in an order different from the order a compiler parses. The tell is not just the presence of those characters but the balance: an embedding opened with U+202A or U+202B, or an override opened with U+202D or U+202E, must be closed by U+202C, and an isolate opened with U+2066 to U+2068 must be closed by U+2069. This page tracks the stack across the whole text and reports any control that is never terminated, along with any stray terminator.
The block from U+E0000 to U+E007F was intended for language tagging and is now deprecated. Codepoints U+E0020 to U+E007E map one-for-one onto printable ASCII and render as absolutely nothing in every normal font, which makes them a clean channel for text a human never sees — watermarks, tracking markers, or instructions aimed at a system that reads the string. The scanner decodes any such run back to the ASCII it spells and shows it.
Cyrillic а (U+0430) and Latin a (U+0061) render identically in almost every typeface but are different characters, so the two spellings of apple.com are different domains. Registrars mostly block labels that mix scripts, which is why the dangerous case is the whole-script confusable: a label written entirely in Cyrillic that still reads as English. The skeleton column shows the Latin string a label imitates once every look-alike is folded, and the A-label column shows the xn-- form that actually gets resolved.
No. This checks characters, not meaning. It cannot tell you that a domain is fraudulent, that an attachment is malicious, or that a message is a scam written entirely in ordinary ASCII — most phishing is. The confusable table is also the widely abused Latin subset of the Unicode confusables data rather than the whole file, so an unusual look-alike may not be named, though its script will still be reported.