The short version
- 1Lookalikes may belong to different scripts.
- 2Normalization alone does not solve confusables.
- 3Identifier restrictions should reflect a defined threat model.
Visual similarity is not equality
Letters from different scripts can look alike while remaining different code points. A Latin a, Cyrillic а, and Greek α are not interchangeable. Attackers may exploit this in identifiers that imitate trusted names.
The problem is contextual: multilingual prose legitimately mixes scripts, while a security-sensitive account identifier may need a narrowly defined repertoire.
Normalization is not a complete defense
Canonical or compatibility normalization resolves defined equivalences and mappings, but it does not collapse every confusable character. Unicode Technical Standard #39 provides data and mechanisms specifically for security review.
Do not invent a visual-similarity table from a font screenshot. Use maintained confusables data and define the threat model for the identifier system.
Protect the decision point
Display canonical identifiers alongside human-readable names for high-risk actions. Detect mixed scripts where appropriate, reserve trusted names, and log the actual code points used.
Natural-language content needs broader script support than login names. Separate those policies so a security control does not exclude legitimate writing.
Follow the ideas that meet here
Unicode Normalization: NFC, NFD, NFKC, and NFKD
Normalization can support a policy but cannot replace one. You can define the equivalence step without overestimating it.
Zero-Width Unicode Characters: Joiners, Spaces, and Hidden Text
Inspect invisible components alongside script mixing. You can identify hidden format controls in suspicious text.
Put this guide to work
Continue with the collections below. Their copy controls, formal names, and character records connect the explanation to inspectable data.
Sources and review notes
This article was written for UnicodeSymbols.com and reviewed against the references below on September 3, 2026. The sources establish technical properties; practical recommendations are clearly presented as editorial guidance.