Spot lookalike domains: punycode and Unicode, mixed scripts and UTS #39 confusables.
New
Invisible Character Detector
Runs locallyNew
Use Invisible Character Detector
What it does
Paste a link, file name, user name or message to list every hidden or deceptive character with its position and code point, see the text with visible markers and copy a cleaned version.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Right-to-left override in a file name
Invoice_7782fdp.exe1 hidden or unusual character: Bidi control (1).
How the text displays (bidi controls active)
Invoice_7782fdp[.]exe
Text with visible markers
Invoice_7782[RLO]fdp[.]exe
Cleaned copy (hidden characters removed, odd spaces replaced by normal spaces)
Invoice_7782fdp[.]exe
Findings
POSITION CODE POINT NAME CATEGORY NOTE
Ln 1, Col 13 U+202E RIGHT-TO-LEFT OVERRIDE Bidi control reverses the text that follows (RLO filename trick)Finds one RIGHT-TO-LEFT OVERRIDE (U+202E) after Invoice_7782: it makes the name display as Invoice_7782exe.pdf although the file ends in .exe. The cleaned copy is Invoice_7782fdp.exe.
FAQ
Which characters does it detect?
Zero-width characters (U+200B to U+200D, U+2060, U+FEFF, U+180E), bidi controls (U+202A to U+202E, U+2066 to U+2069, LRM, RLM, ALM), unusual spaces, the soft hyphen, the grapheme joiner, Hangul fillers, tag characters (decoded to the ASCII text they hide), variation selectors, interlinear annotation marks, invisible math operators, control characters and other format characters.
Is every finding a sign of an attack?
No. Non-breaking spaces are common in copied text, and emoji use joiners, variation selectors and tag characters for flags; these are listed as notes. Bidi overrides, tag characters outside a flag and long runs of variation selectors are the strong signals.
Is my text sent anywhere?
No. Scanning and cleaning run on this page and nothing is uploaded. Texts up to 1 MB are scanned in full; longer input is cut at 1 MB.