16 October 2026 · 2 min read
What is a homoglyph, and why does it matter?
A homoglyph is a character that looks like another one but isn't it — Cyrillic “а” standing in for Latin “a” — and the mismatch quietly breaks domain names, filters and anything that compares text.
A homoglyph is a character that looks like a different character but isn't it. Cyrillic а (U+0430) and Latin a (U+0061) render identically in most fonts, so pаypal and paypal are two different strings that look like one — and nothing in software compares letters by how they look.
Why the mismatch matters
- Phishing. Someone can register a domain name built from look-alike letters. The famous demonstration, in 2017, was a domain made entirely of Cyrillic characters that displayed as
apple.com. Browsers now fall back to showing the rawxn--punycode for names that mix scripts in suspicious ways, but that is a heuristic and not a fix. - Filters. A banned word with one letter swapped is no longer the banned word, which is why moderation and blocklists normalise text before matching it.
- Everything that compares strings. Search, deduplication, logins, plagiarism matching. Two records that look identical sit side by side as separate rows, and nobody can see why.
How you find them
Unicode publishes confusable data as part of UTS #39. It maps characters to a "skeleton" form, so two strings can be reduced and compared for look-alikeness. It's useful rather than complete: the data is thin for Han and for several South and Southeast Asian scripts, and ASCII has its own look-alikes — the skeleton treats rn as confusable with m.
The quicker check on a piece of text is which script each letter belongs to. One Cyrillic or Greek letter sitting inside an otherwise English word is a strong signal on its own.
What a homoglyph doesn't tell you
Who wrote the text. Look-alike letters arrive from keyboard layouts, sloppy transliteration, a paste out of a PDF, a template someone edited years ago, and from people deliberately swapping characters to break a text match. No AI vendor has published that it substitutes look-alike letters in its output, and a mark built that way would survive only until someone normalised the text.
Scan text for look-alike letters — it names the code point and the script each one came from.
Check something yourself
Every tool here runs in your browser and is free. See what your files and text actually carry.