Skip to content

# Unicode Inspector

Break text into its characters and see each one's codepoint, UTF-8 bytes, and general category, plus the character and byte counts, then open any character for its full record: name, script, block, plane, bidirectional class, combining class, East Asian width, and the UTF-16/UTF-32, HTML and Rust/JavaScript/CSS escape forms. Useful for spotting invisible or look-alike characters, against a copy of the Unicode 16.0.0 character database built into the page.

## A worked example

Every character of `Hi 🌟 café─`, broken down by the same Unicode 16.0.0 catalog the interactive version uses.

Per-character breakdown
Codepoint | Character | UTF-8 | General category
--- | --- | --- | ---
U+0048 | H | 48 | Lu (Uppercase Letter)
U+0069 | i | 69 | Ll (Lowercase Letter)
U+0020 | U+0020 | 20 | Zs (Space Separator)
U+1F31F | 🌟 | F0 9F 8C 9F | So (Other Symbol)
U+0020 | U+0020 | 20 | Zs (Space Separator)
U+0063 | c | 63 | Ll (Lowercase Letter)
U+0061 | a | 61 | Ll (Lowercase Letter)
U+0066 | f | 66 | Ll (Lowercase Letter)
U+00E9 | é | C3 A9 | Ll (Lowercase Letter)
U+2500 | ─ | E2 94 80 | So (Other Symbol)

## Every attribute of one character

The full per-character record for `U+2500`, the box-drawing character the command line uses as its example (`unicode-cli U+2500`).

Name
  BOX DRAWINGS LIGHT HORIZONTAL
Codepoint
  U+2500
General category
  So (Other Symbol)
Script
  Common
Block
  Box Drawing
Plane
  0 (Basic Multilingual Plane)
Bidirectional class
  ON (Other Neutral)
Combining class
  0
Mirrored
  no
East Asian width
  A (Ambiguous)
UTF-8
  E2 94 80
UTF-16
  2500
UTF-32
  00002500
HTML entity
  &#x2500; · &#9472;
Rust escape
  \u{2500}
JavaScript escape
  \u2500
CSS escape
  \002500

## Security inspector

A worked scan of a sample that carries a right-to-left override, a zero-width space, a Cyrillic look-alike and a decomposed accent. 5 findings, led by bidirectional control characters (trojan-source risk).

Security findings
Severity | Finding | Why it matters | Characters
--- | --- | --- | ---
High | Bidirectional control characters (trojan-source risk) | This text contains bidirectional formatting controls. They reorder how characters are displayed without changing the stored order, so what a reader sees can differ from what a program parses or a compiler builds. In source code or an identifier that gap is the trojan-source technique. The characters are real Unicode controls with legitimate uses in right-to-left text; flagging them is not a claim of wrongdoing. | U+202E RIGHT-TO-LEFT OVERRIDE (right-to-left override); U+202C POP DIRECTIONAL FORMATTING (pop directional formatting)
Medium | Invisible or zero-width characters | These characters take little or no space and often render as nothing, so text can carry content a reader cannot see: hidden joins, a smuggled marker, or a space that is not the ordinary space. Each is shown here by its codepoint so it is never rendered as nothing. | U+200B ZERO WIDTH SPACE (zero-width space: takes no width and shows nothing)
Medium | Confusable characters (homoglyphs) | These characters look like ASCII letters or digits but are different codepoints, the technique behind look-alike domain names and spoofed identifiers. A name that reads as ASCII may not be. This uses the full Unicode confusables data, every script pair of it. | U+0430 CYRILLIC SMALL LETTER A (looks like ASCII "a")
High | Mixed scripts: Latin, Cyrillic | This text combines characters from more than one writing system. That is normal in many languages (Japanese mixes Han, Hiragana and Katakana; text often carries Latin punctuation), so a mix is not itself a problem. It matters when a word that looks like one script hides characters from another, the way a look-alike domain is built. | none
Informational | Not in NFC (composed) form | This text is not in NFC, Unicode's composed normalization form. It will look the same as its composed version but is a different sequence of codepoints, so a byte-for-byte comparison would call the two unequal. The normalization workbench shows all four forms side by side. | none

## Look-alike characters

Unicode records which characters can be mistaken for which, across every writing system. `pаypal.com` and `paypal.com` reduce to the same comparison key (`paypal.corn`), which is why a look-alike domain works. 23 characters can be mistaken for the letter `a` alone.

Characters that look like the letter a
Codepoint | Character | Script | Name
--- | --- | --- | ---
U+0251 | ɑ | Latin | LATIN SMALL LETTER ALPHA
U+03B1 | α | Greek | GREEK SMALL LETTER ALPHA
U+0430 | а | Cyrillic | CYRILLIC SMALL LETTER A
U+237A | ⍺ | Common | APL FUNCTIONAL SYMBOL ALPHA
U+FF41 | ａ | Latin | FULLWIDTH LATIN SMALL LETTER A
U+1D41A | 𝐚 | Common | MATHEMATICAL BOLD SMALL A
U+1D44E | 𝑎 | Common | MATHEMATICAL ITALIC SMALL A
U+1D482 | 𝒂 | Common | MATHEMATICAL BOLD ITALIC SMALL A
U+1D4B6 | 𝒶 | Common | MATHEMATICAL SCRIPT SMALL A
U+1D4EA | 𝓪 | Common | MATHEMATICAL BOLD SCRIPT SMALL A
U+1D51E | 𝔞 | Common | MATHEMATICAL FRAKTUR SMALL A
U+1D552 | 𝕒 | Common | MATHEMATICAL DOUBLE-STRUCK SMALL A
U+1D586 | 𝖆 | Common | MATHEMATICAL BOLD FRAKTUR SMALL A
U+1D5BA | 𝖺 | Common | MATHEMATICAL SANS-SERIF SMALL A
U+1D5EE | 𝗮 | Common | MATHEMATICAL SANS-SERIF BOLD SMALL A
U+1D622 | 𝘢 | Common | MATHEMATICAL SANS-SERIF ITALIC SMALL A
U+1D656 | 𝙖 | Common | MATHEMATICAL SANS-SERIF BOLD ITALIC SMALL A
U+1D68A | 𝚊 | Common | MATHEMATICAL MONOSPACE SMALL A
U+1D6C2 | 𝛂 | Common | MATHEMATICAL BOLD SMALL ALPHA
U+1D6FC | 𝛼 | Common | MATHEMATICAL ITALIC SMALL ALPHA
U+1D736 | 𝜶 | Common | MATHEMATICAL BOLD ITALIC SMALL ALPHA
U+1D770 | 𝝰 | Common | MATHEMATICAL SANS-SERIF BOLD SMALL ALPHA
U+1D7AA | 𝞪 | Common | MATHEMATICAL SANS-SERIF BOLD ITALIC SMALL ALPHA

## Normalization workbench

The four normalization forms of `ﬁlé ²`. They can render alike yet be different codepoint sequences, and compatibility forms fold distinctions away.

Normalization forms
Form | Text | Codepoints | Bytes | Scalars | Graphemes
--- | --- | --- | --- | --- | ---
NFC | ﬁlé ² | U+FB01 U+006C U+00E9 U+0020 U+00B2 | 9 | 5 | 5
NFD | ﬁlé ² | U+FB01 U+006C U+0065 U+0301 U+0020 U+00B2 | 10 | 6 | 5
NFKC | filé 2 | U+0066 U+0069 U+006C U+00E9 U+0020 U+0032 | 7 | 6 | 6
NFKD | filé 2 | U+0066 U+0069 U+006C U+0065 U+0301 U+0020 U+0032 | 8 | 7 | 6

NFC and NFD render the same but are different codepoint sequences: one composes marks into single characters, the other splits them out. A byte comparison would call them unequal.

Compatibility normalization (NFKC/NFKD) changes this text: it folds away distinctions like ligatures, super/subscripts, and fullwidth forms (fi becomes f i, squared becomes 2, fullwidth A becomes A). That is useful for loose matching, but it can collapse two strings a person reads as different into one, so it is the wrong choice for round-tripping exact text.

This is generated in browser and is not sent to pah.moi servers.

About this tool3 paragraphs

Past the per-character record there is a security pass: invisible and zero-width characters, always shown by codepoint rather than as nothing; bidirectional controls, with the trojan-source pattern named outright; mixed scripts; confusable homoglyphs; and text that is not in normal form. Its wording is deliberately educational rather than accusatory, because unusual text is usually just text.

A normalization workbench puts NFC, NFD, NFKC and NFKD side by side with the codepoint sequences before and after and the byte, scalar and grapheme counts, so a compatibility form that silently rewrites what you typed is visible instead of surprising. Search takes a codepoint, part of a name, or a descriptive word like `arrow`, `box drawing` or `currency`, and a terminal glyph matrix marks each cell's East Asian width so a box-drawing set can be picked without breaking a monospace layout.

The character database is a copy compiled into the page when the site was built, so this tool is exactly as current as that copy and never asks a server for anything. The confusable relation is the full UTS #39 table for single-codepoint sources, and a lookalike is a claim about shape, not intent: two characters can be confusable and both entirely legitimate. What you actually see also depends on the fonts your browser has, which is the one thing a codepoint cannot tell you.

Use it locally This tool has a native command line twin. Build `unicode-cli` from the site's source with:

    cargo build --release --bin unicode-cli

Source and licence terms