Unicode Lookalike Characters and Confusables

Confusables are Unicode characters that look alike but are not the same character. The Greek capital Alpha and the Latin capital A are indistinguishable in most fonts and have different code points, which makes them useful for spoofing and a nuisance for search.

Why lookalikes exist

Unicode encodes characters by identity, not appearance. Greek Alpha is a Greek letter and Latin A is a Latin letter; they serve different writing systems and each needs its own code point, regardless of how similar the printed forms are. Multiply that across Cyrillic, Greek, Latin and mathematical alphabets and thousands of visual collisions follow.

The security angle

Substituting a Cyrillic а for a Latin a produces a domain name or username that reads identically and points somewhere else entirely. This is called a homograph attack. Browsers and registrars defend against it with mixed-script restrictions and by displaying the raw punycode when a name looks suspicious, but the underlying ambiguity is permanent.

Where it affects ordinary use

Styled Unicode text is confusables by construction — every character is a lookalike of the letter it replaces. That is exactly why a styled username cannot be found by searching for its plain spelling, and why some services reject mixed-script input in identifier fields.

How to check

Look up the code point. Two characters that render the same will have different U+ values, and that is conclusive in a way that squinting at the screen never is. Unicode publishes a confusables data file and a technical report on security mechanisms for systems that need to detect this automatically.

Practical guidance

For anything identifying — usernames, domains, filenames, database keys — keep to a single script and to ordinary characters. Save the lookalikes for display text where being found does not matter. If you accept user input that becomes an identifier, normalise it and consider restricting it to one script.

References

Related tools and guides

Last updated September 2026 · Editorial policy · How we verify Unicode claims