Punycode & Homograph Detector
Spot spoofed lookalike domains.
Runs entirely in your browser — nothing you enter is uploaded, logged, or tracked.
Internationalised domains can hide an attack: a domain that looks like apple.com might actually use a Cyrillic “а”. Paste a URL or domain to decode any punycode (xn--) labels back to Unicode and flag suspicious signs — mixed scripts and characters that imitate ASCII letters — so you can tell a real domain from a convincing fake.
Frequently asked questions
What is a homograph attack?
Using Unicode characters that look like familiar ASCII ones — Cyrillic а, Greek ο, etc. — to register a domain that visually impersonates a real one. Browsers often display the punycode (xn--) form to defend against it.
What does it check?
It decodes any xn-- (punycode) labels to their real Unicode, then flags labels that mix character scripts or use confusable look-alike characters — the hallmarks of a spoofed domain.
Is my URL uploaded?
No — decoding and analysis happen entirely in your browser.