Unicode Inspector
See every character in a text with its code point and name, and find hidden or look-alike characters.
Loading Unicode Inspector… If nothing happens, please enable JavaScript.
Text that looks identical on screen can be very different underneath. A word copied from a PDF may contain a soft hyphen, a username may hide a zero-width space, a link may swap the Latin a for the Cyrillic а, and an accented letter may be stored as one character or as a base letter plus a combining accent. The Unicode Inspector breaks any text into its user-perceived characters (grapheme clusters) and lists every code point inside them with its U+ number, official Unicode name, general category and block, so you can see exactly what you are dealing with.
Examples
é (one code point)
U+00E9 LATIN SMALL LETTER E WITH ACUTE
NFC form, 2 bytes in UTF-8.
é (two code points)
U+0065 + U+0301 COMBINING ACUTE ACCENT
NFD form, looks identical but compares as different.
pаypal (with Cyrillic а)
U+0430 CYRILLIC SMALL LETTER A
Flagged as a mixed-script word.
Frequently asked questions
How do I find a zero-width space in my text?
What is the difference between a character, a code point and a byte?
Why do two strings that look the same not match?
What are NFC, NFD, NFKC and NFKD?
What is a homoglyph or mixed-script attack?
What are bidirectional control characters and why are they flagged?
Is my text uploaded anywhere?
Where do the character names come from?
About Unicode Inspector
The tool flags the characters that usually cause trouble. Invisible format characters such as the zero-width space, zero-width joiner, word joiner and byte order mark; bidirectional controls like RLO and LRI, which can visually reorder text and were the basis of the "Trojan Source" attack on source code; no-break, thin and other unusual spaces that do not match a normal space in code or search; blank-looking letters used to fake empty names; and words that mix Latin with Cyrillic or Greek letters, the classic homoglyph trick behind phishing domains. Emoji sequences are recognised, so the joiners inside 👩🏽💻 are not reported as suspicious.
Click any row to get every representation of that code point: UTF-8 bytes, UTF-16 code units, HTML numeric and named entities, JavaScript, CSS and Python escapes, and the URL-encoded form. The counters above the table show the number of graphemes, code points, UTF-16 units (what JavaScript's length returns) and UTF-8 bytes, which explains why a database column, an SMS or a tweet counts your text differently from what you see.
The normalization panel compares the four Unicode normalization forms (NFC, NFD, NFKC, NFKD) and lets you copy or inspect any of them, which is how you fix strings that look equal but fail an equality test. Finally, the clean-up panel removes invisible and bidirectional characters, replaces exotic spaces with a normal one, drops stray control characters and optionally normalizes the result, leaving emoji intact. Character names and blocks come from the official Unicode Character Database, and everything runs locally in your browser.
UTF-8 was designed on a diner placemat
In September 1992, Ken Thompson and Rob Pike of Bell Labs were unhappy with the proposed multibyte encoding for the new universal character set. Over dinner at a diner in New Jersey, Thompson sketched a better scheme on a placemat: ASCII stays one byte, no byte of a multibyte sequence can be mistaken for an ASCII character, and you can always find the start of a character by looking at the top bits. They implemented it in the Plan 9 operating system within days.
That design is UTF-8, and its backward compatibility with ASCII is why it took over the web, where the large majority of pages now use it. Unicode itself had started a few years earlier, with Joe Becker's 1988 proposal for a "Unicode" character set and the first version of the standard published in 1991.
The flexibility that made Unicode universal also created new security problems. In 2017 a researcher registered a domain written entirely in Cyrillic letters that browsers displayed as apple.com, which pushed browsers to show such names in their punycode form. In 2021, the Trojan Source paper from the University of Cambridge showed that bidirectional control characters could make source code display differently from how a compiler reads it.