The idn command converts punycode both ways and reports confusables, mixed scripts and the homograph risk level.
# decode punycode and check for lookalikes
python cli.py idnxn--pypal-4ve.com# full structured JSON (unicode, punycode, scripts, confusables, risk)
python cli.py idnxn--pypal-4ve.com--json
THE BIG DIFFERENCE
Detect spoofed domains from inside your AI
This tool speaks the Model Context Protocol (MCP) and ships a REST API. Connect it once, then just ask your assistant whether a link is a lookalike before you ever click it.
An internationalized domain name (IDN) is a domain that contains characters outside the plain ASCII a to z, such as accented letters or non-Latin scripts. Because the DNS itself only carries ASCII, every IDN is encoded into a special ASCII form called punycode, marked by the xn-- prefix. For example the Unicode domain müller.de is stored as xn--mller-kva.de. This tool converts freely in both directions so you can always see the real Unicode a punycode label expands to.
What is a homograph attack?
A homograph (or homoglyph) attack registers a domain that looks the same as a trusted one by replacing letters with confusable characters that render identically. A Cyrillic small letter a (U+0430) is visually indistinguishable from a Latin a (U+0061), so an attacker can register xn--pypal-4ve.com, which displays as pаypal.com, and use it to impersonate PayPal. The victim sees a familiar name in the address bar but lands on a phishing site.
How confusables and mixed scripts enable phishing
Two signals give these attacks away, and this checker looks for both:
Confusable characters: single glyphs from other scripts that mimic Latin letters. The tool computes the ASCII skeleton of the domain, the plain-letter shape it resembles, so you can see at a glance which trusted brand it is imitating.
Mixed scripts: a label that combines more than one writing system, for example Latin plus Cyrillic. Genuine brand domains almost never mix scripts, so mixing is a strong red flag on its own.
The checker lists every script it finds, every confusable character with the Latin letter it imitates, and rolls the findings into a single risk verdict of none, low or high.
How to protect yourself
Before you trust a link, paste it here and read the Unicode form and the ASCII skeleton.
Treat any mixed-script or high risk verdict as hostile until proven otherwise.
Type important domains by hand or use bookmarks instead of clicking links in email.
Keep your browser updated. Modern browsers show punycode instead of Unicode for suspicious mixed-script labels, but coverage is uneven, so an explicit check is safer.
Frequently asked questions
What is a homograph attack?
A homograph attack registers a domain that looks identical to a trusted one by swapping letters for lookalike characters from other scripts, for example a Cyrillic a that looks exactly like a Latin a. The address bar appears to show paypal.com but it is a different domain leading to a phishing site. This tool decodes the punycode, flags the confusable characters and gives a clear risk verdict.
What is punycode and what does xn-- mean?
Punycode is the ASCII encoding used to represent Unicode domain names in the DNS. An IDN such as münchen.de is transmitted as xn--mnchen-3ya.de, and the xn-- prefix marks a label as punycode. This tool converts freely in both directions so you can see the real Unicode a punycode domain expands to.
Is the Punycode & Homograph Checker free and open source?
Yes. It is completely free and open source under the MIT license, part of WebToolsHub by Konko Maji. It converts punycode and analyses confusable and mixed-script characters. There is no signup and no data is stored.
What is a mixed-script domain?
A mixed-script domain mixes characters from more than one writing system in a single label, for example Latin letters combined with Cyrillic or Greek. Legitimate brand domains almost never do this, so a mixed-script label is a strong signal of a spoofing attempt. The checker lists every script found and flags mixing as a risk factor.
Can I run the homograph checker inside Claude, ChatGPT or Gemini?
Yes. It ships an MCP server and a REST API, so you can connect it to Claude, ChatGPT, Gemini, Kimi, Cursor and any MCP client, then ask your assistant to check whether a domain is a lookalike before you click it. See the connection guide.