Skip to content
QR Code Tools logo
QR Code Tools
Sign in
Security Tool

QR Homograph Detector

Check a domain for Unicode confusable characters — letters from other alphabets that look identical to Latin letters. Each flagged character is shown with its position and the ASCII letter it imitates. Everything runs in your browser; nothing is sent anywhere.

1. Enter the domain

Method: every character is compared against a table of known confusable characters (Cyrillic, Greek, fullwidth, and other lookalikes) mapped to the ASCII letter they resemble. The skeleton is the domain with each confusable replaced by its ASCII lookalike.

Result
Verdict
No confusable characters found
Confusables found0
Mixed scriptsNo
ASCII skeletonpaypa1.com

The Domain That Is Not What It Looks Like

Homograph attacks work because people read shapes, not code points. A Cyrillic “а” and a Latin “a” are indistinguishable on screen, but to a computer they are different characters leading to different domains. On a printed QR code the danger is worse: the scanner never sees the domain at all until the code is already scanned, so a lookalike destination hides in plain sight.

How to check a destination

Paste the domain here, compare the ASCII skeleton with the brand you expect, and treat any confusable as a hard stop. For domains you own, register the lookalike variants defensively or monitor them — attackers only need one victim to click.

Frequently Asked Questions

What is a homograph attack?

An attacker registers a domain that looks identical to a trusted one by swapping in characters from another alphabet — for example a Cyrillic "а" in place of a Latin "a". The two domains look the same but go to different places. This tool flags those swaps.

What is the "ASCII skeleton"?

The domain with every known confusable character replaced by the ASCII letter it resembles. If the skeleton differs from what you typed, the typed domain contains lookalikes. Comparing the skeleton to the brand name you expected is the quickest check.

Does a clean result mean the domain is safe?

No. This tool checks only for Unicode confusables in the text you enter. A domain can be clean here and still be a typo-squat, a lookalike brand name, or a malicious site. Treat a clean result as one check passed, not a safety verdict.

Why flag mixed scripts at all?

Legitimate domains occasionally mix scripts, but a domain that mixes Latin with Cyrillic or Greek in a single label is unusual and is exactly the shape homograph attacks take. Mixed script alone is a warning, not proof of malice.