--- id: confusable-homoglyphs version: "3.3.1" license: MIT license_treatment: permissive maintenance: abandoned --- # confusable-homoglyphs — Detect confusable usage of unicode homoglyphs, prevent homograph attacks. License: permissive · Maintenance: abandoned · Downloads: 1.5M/mo ## What it is and what it does confusable_homoglyphs detects when Unicode characters that look identical or nearly identical to each other are mixed in a single string—a technique attackers use to impersonate legitimate usernames or domains. For example, a Greek letter alpha (Α) looks almost identical to a Latin A, so 'ΑlaskaJazz' could fool users into thinking they're interacting with 'AlaskaJazz'. The library checks strings against Unicode Consortium data to identify these dangerous combinations and can be configured to allow only specific scripts (like Latin-only usernames) or to flag only confusable characters from particular Unicode blocks. The package ships with pre-built JSON data files derived from official Unicode security data, so it works out of the box with no external dependencies. It supports Python 3.7 through 3.12 and exposes a simple API for checking whether a string is dangerous, whether it contains confusable characters, and what script blocks are present. The repository is archived and no longer maintained, but the last release included unicode data updates. Use it for: - Validate usernames during account creation to prevent attackers from registering lookalike accounts like 'ΑlaskaJazz' or 'Gооgle'. - Check domain names before allowing them in a whitelist or before displaying them to users to prevent phishing via homograph attacks. - Filter user-generated content or comments to flag mixed-script strings that might be attempts to evade moderation or impersonate other users. - Validate email addresses or social media handles to ensure they don't use confusable characters that could mislead recipients. - Build security tooling that alerts administrators when suspicious homoglyphs appear in logs or authentication attempts. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Detects Unicode homoglyphs and mixed-script strings that could be used in spoofing attacks, helping prevent homograph attacks where visually similar characters trick users. Yes, if you need to detect homograph attacks in usernames, domains, or user-generated text. The package is stable, has no dependencies, and installs easily. However, be aware the repository is archived and unmaintained—unicode data is current as of 2024-01-30, but you should monitor whether future Unicode standards require updates. Suitable for production use in security-sensitive contexts where the risk of homograph attacks justifies the maintenance trade-off. ## Install pip install confusable-homoglyphs uv add confusable-homoglyphs poetry add confusable-homoglyphs ## Installing confusable-homoglyphs Before you install: Low friction: pure Python wheel with no runtime dependencies. Repository is archived and maintenance is abandoned as of 927 days ago, though the latest release (2024-01-30) includes unicode data updates and the package is marked Production/Stable. License in practice: MIT license (permissive) places no restrictions on use, modification, or distribution in proprietary or open-source projects. Quickstart: pip install confusable-homoglyphs from confusable_homoglyphs import confusables # Check if a string contains confusable characters is_dangerous = confusables.is_dangerous('ΑlaskaJazz') print(is_dangerous) # True: mixed-script with confusable Greek alpha Verify before relying: - Whether the unicode data (categories.json, confusables.json) remains current after 2024-01-30 without active maintenance. - Performance characteristics when checking large batches of usernames or domains. - Whether the CONFUSABLE_DATA environment variable feature is documented and stable. ## Package facts - License: MIT (permissive) - Python support: unspecified - Install friction: low - Maintenance: abandoned - Downloads: 1.5M/month (top 5,000 on PyPI) - Known vulnerabilities: none known ## Tags homoglyph detection, unicode spoofing prevention, homograph attack detection, confusable characters, mixed-script validation, unicode security, character confusion detection, security, unicode, homograph-attack [View on SkillFed](https://skillfed.io/packages/confusable-homoglyphs) · [View on PyPI](https://pypi.org/project/confusable-homoglyphs/)