Unicode Inspector

Reads a string by Unicode code point (correctly pairing a UTF-16 surrogate pair into one character, unlike .length or .split(''), both of which operate on UTF-16 code units), shows the UTF-8 byte encoding of each, and reports the four Unicode normalization forms.

Text that reads differently from what it is

Bidirectional controls such as RIGHT-TO-LEFT OVERRIDE (U+202E) change the order characters are displayed in without changing the order they are stored in. In source code that lets a reviewer see one program while the compiler reads another — the Trojan Source technique, CVE-2021-42574. An override or isolate still open at the end of a line is flagged as an alert; balanced pairs, which legitimate right-to-left text uses, are flagged more quietly.

Zero-width characters, tag characters (which can carry a whole hidden sentence), stray control characters and look-alike spaces are flagged too, and every one of them is shown in the output as a visible marker such as [U+200B ZWSP], so the report itself cannot be reordered or hide anything.

Mixed scripts, not a confusables table

A word that mixes Latin, Cyrillic and Greek letters is flagged, because that is the usual shape of a homoglyph spoof — a Cyrillic а (U+0430) standing in for a Latin a (U+0061). This tool does not bundle Unicode's confusables data, so a look-alike drawn entirely from one other script is not detected.

No character-name lookup

Ordinary code points are shown by number (e.g. U+0041) only, not a name like "LATIN CAPITAL LETTER A" — a name database is several megabytes and this tool does not bundle one. The flagged characters above are the exception: each carries its Unicode name.

é can be one composed code point (NFC) or an "e" followed by a combining acute accent (NFD) — both render identically but compare unequal in code, or in a database that does not normalize before matching. The normalization panel shows both forms explicitly so the difference is visible rather than invisible.