Lookalike characters

A trapped link can replace Latin letters with characters that look the same: a Cyrillic “а” instead of “a”, a fraction slash “⁄” instead of “/”. Paste the link here before clicking it.

In an email or a message, copy the link’s address (long press or right click, “Copy link”), not the text shown: they can differ.

Try:

Transparency

Everything happens in this page. The link you paste is never sent anywhere: not to the server of r-no.fr, not to anyone else. It may contain a secret (a password reset link, a personal tracking link): it stays in your browser.

How it works
Each character of the site name is looked up in the Unicode table of confusable characters (UTS #39), which says what it looks like. Your browser is then asked what it would do with this character in an address: keep it, convert it, remove it or refuse the address. The answer is that of your browser, not a guess.
Enforced by your browser
This page’s Content Security Policy allows a single destination, the site's audience measurement (connect-src https://stats.r-no.fr, see below), and forbids any form submission (form-action 'none'): even a flaw in the script could not send the link anywhere but to that server, which belongs to R-no. You can read the policy at the top of the page source.
Audience measurement
Like every page of the site, this one counts its visit with Umami, installed on R-no’s own server (stats.r-no.fr). It receives the address of the page, without parameters or anchor, the site you came from (its domain only), your browser, system, language and screen size, and the country, region and city deduced from your IP address, which is not kept. It never receives what you type, nor the result of the tool. No cookie, nothing stored in your browser; if your browser asks not to be tracked (Do Not Track), nothing is measured. The data is erased after 25 months.
  • /commun/mesure.js: the filter applied before each sending, written for R-no Toolbox. 1.4 kB
    SHA-256 225eec74fd12623d82fc05ee7d222be629ce454d081c129e8d1e249ed37ee716
  • https://stats.r-no.fr/m.js: Umami’s tracker, open source (MIT), served by the measurement server. Its fingerprint is not shown here: it changes with each version of Umami, and you cannot check from your browser that it is the published code. For that part, you have to trust R-no.
What is stored
No cookie, and nothing in the address of this page. A link sent by the QR code decoder arrives after a #, which browsers never send to the server, and is removed from the address as soon as it is read. What you type is not kept. Your language is given by the address itself (/en/ or /fr/): nothing is stored to remember it. Like any website, the server records the download of the page and its files in its access logs (IP address, date and time, address requested, browser name).
Unicode data
confusables.js is the official Unicode table, version 17.0.0 (22 July 2025), kept to the 1,580 characters that imitate a Latin letter, a digit, a dot, a hyphen or a slash, each with its Unicode name. It is rebuilt from the official file and compared byte for byte on every deployment. Unicode License v3, reproduced at the top of the file.
Code that runs here
  • app.js: reads the link character by character, asks your browser what it would do with each one, and shows the result. Written for R-no Toolbox, not minified, no third-party library. 29.3 kB
    SHA-256 62c86c6ff0e109138de3bed8e2a94413489f5f6e2e886c9fafc7db840b9cc9a2
  • confusables.js: the Unicode table of confusable characters. Data only, no logic. 86.2 kB
    SHA-256 3cca4ed7978dc56d266242b9e3b937fbe562df88a89bde4af1e96bf02a14a1ad
  • textes.js: the French messages of the tool, shown by its script (the rest of the French page is written into its HTML when the site is built). It only defines texts, with no logic. 11.3 kB
    SHA-256 de349a51fdfd639950c1c06f09c80140691ba0ace5335444aa432dc8aec8e58d
  • /commun/langue.js: the language helper, the same on every page of the site. It reads the language of the page and gives the tool its messages in that language. It stores nothing. 1.6 kB
    SHA-256 80f76f69773ef628d36d09bf8387cfedebda4529210d7120649b6f5603310631
Tested
Some fifty trapped and genuine links (Cyrillic, Greek and Armenian letters, fake slashes and hyphens, invisible characters, digits, @, disguised IP addresses, accented and Japanese names) are checked by automated tests, run on every deployment.
Check it yourself
Download the script and compare its fingerprint with the one above:
curl -s https://r-no.fr/domains/lookalike/app.js | shasum -a 256
Limits
  • Not a safety verdict. A site with an honest-looking name can be malicious, and a name with an accent can be genuine. The page gives clues; you decide.
  • Only disguised characters are detected. A typo made with ordinary letters (“paypall.com”), a lookalike made of two letters (“rn” for “m”) or a brand name followed by a word (“impots-remboursement.com”) are not.
  • Digits 0, 1 and 5 next to letters are flagged, because they can pass for o, l and s. Many genuine names contain digits: this clue only asks you to look.
  • Only the site name is analysed, not the rest of the address. The site shown in bold (the last two parts of the name, three after co.uk and the like) is an approximation.
  • The answer depends on your browser: another browser, or an older one, may treat a rare character differently.
  • The page opens nothing: it does not follow shortened links or redirections, and does not know where they lead.