String Obfuscator
Replace Latin characters with Unicode lookalikes (homoglyphs). Defeats simple copy-paste search while looking identical.
String Obfuscator — Unicode Homoglyphs
Homoglyph obfuscation replaces characters with visually identical Unicode alternatives from Cyrillic, Greek, and other scripts. The result looks the same to human readers but is not equal as a byte string, defeating simple text search, plagiarism scanners, and keyword filters. Use for watermarking text, bypassing content filters in testing, or studying Unicode security properties. Note: modern plagiarism detection tools are aware of this technique.
44 of the 52 Latin letters have a substitute, and digits have none. That is deliberate: the substitute has to be indistinguishable in whatever font the text ends up in, and for f k m t z D F G and every digit, the closest candidates Unicode offers are circled, subscript, fullwidth or small-capital forms — all visibly the wrong size. Those characters pass through untouched rather than being replaced with something a reader would notice.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Demonstrating a homoglyph attack for a security write-up or a training exercise.
- Testing whether a validator or a filter normalises confusable characters.
- Checking how your own search or comparison behaves against lookalike input.
- Producing a sample for an anti-phishing detection test.
- Illustrating why visual equality is not string equality.
Frequently Asked Questions
- How does homoglyph obfuscation work?
- Latin letters are replaced with visually identical characters from other Unicode blocks — Cyrillic `а` for Latin `a`, Greek `ο` for `o`. The text reads normally and every byte is different, which is what defeats an exact-string match.
- What is this legitimately used for?
- Testing. Any system that filters, matches or deduplicates text should be checked against homoglyph substitution, because attackers use it against spam filters and phishing detectors. Generating the input is how you find out whether your filter is fooled.
- Why are some characters left alone by design?
- Because no convincing homoglyph exists for them, and substituting a poor lookalike defeats the purpose — the point is that a human cannot see the difference. The unmapped set is documented rather than filled with approximations.
- Is this how homograph domain attacks work?
- Exactly. A domain registered with a Cyrillic `а` renders identically to the real one, which is why browsers display punycode for mixed-script domains and why registrars restrict scripts within a single label. The attack is old and the defences are why it mostly fails now.
- Will obfuscated text break anything?
- Frequently, which is the point of testing with it. Search stops matching, sorting changes, uppercasing behaves differently, and a database with a Latin-only collation may reject it outright. Anywhere that happens is a place your input handling needs a normalisation step.
Common errors and gotchas
- Treating it as protection. Anything that normalises Unicode defeats it immediately.
- Using it on content that must remain searchable, since the text no longer matches itself.
- Breaking accessibility, because a screen reader will pronounce the substituted characters wrongly or not at all.
- Assuming the substitutions survive a copy-paste through a system that normalises input.
- Using it to evade a filter in production, which is a spoofing technique rather than a privacy measure.