Inspect Unicode · browser-local
Mixed Script Detector
See which writing systems your text uses. GlyphSift counts letters by script so you can tell legitimate multilingual text from a single word that secretly mixes, for example, Latin and Cyrillic.
- Index state
- eligible
- Reviewed
- 2026-08-24
- Input limit
- 5,000 graphemes
Mixed Script Detector
- Latin10 letters
- Cyrillic2 letters
Multiple scripts can be legitimate multilingual text, but mixed scripts in a single word can indicate a spoofing attempt. Review with the confusable checker.
Good fit
Use this tool when
- You want to know which scripts appear in text.
- You suspect a look-alike substitution in a name or URL.
- You are reviewing content for spoofing risk.
Keep the original
Avoid it when
- You expect multilingual text and mixing is normal.
- You need the exact confusable characters, not just scripts.
- You are counting characters rather than classifying them.
Reviewed truth vectors
Examples that expose the edge cases
paypal1 writing system: LatinA single script is normal.
paypаl2 writing systems: Latin + CyrillicOne Cyrillic letter hides among Latin ones.
日本語 text2 writing systems: Han + LatinLegitimate multilingual text also reports multiple scripts.
Transparent implementation
How it works
- 01
Classify each cased letter by its Unicode script.
- 02
Ignore script-neutral punctuation and symbols.
- 03
Report the scripts present and flag when more than one appears.
Known limitations
What the result cannot promise
Multiple scripts are often legitimate multilingual text, not spoofing.
It classifies letters only, not every symbol.
It does not implement the full UTS #39 restriction levels.
Questions before copying
Frequently asked questions
Does mixed script mean spoofing?
Not by itself. Multilingual text mixes scripts legitimately; concern rises when scripts mix inside a single word or a domain name.
Which scripts are recognized?
Common scripts such as Latin, Cyrillic, Greek, Han, Arabic, and Hebrew are classified; others are grouped as other.
Is this full UTS #39?
No. It is a practical script signal, not the complete Unicode security restriction-level algorithm.
Experience, expertise & trust
How we verify this tool
Automated evidence
- Tool-contract & coverage suite30 deterministic cases
tests/tools-30.test.mjs mirrors the ToolRunner dispatch and asserts every registered engineId returns the contracted output shape, plus a coverage guard so no tool silently drops characters.
Run in: node --test after a production build (vinext build) - Rendered-HTML suite12 deterministic cases
tests/rendered-html.test.mjs renders the deployed server bundle and asserts the Unicode-version manifest and each wave's tool markup are present in the server-rendered HTML.
Run in: node --test against the built dist/server bundle - Unicode inspection suite11 deterministic cases
tests/unicode-inspection.test.mjs verifies grapheme/code-point/byte counting and hidden-control detection using explicit \u escapes for combining and bidirectional characters.
Run in: node --test against the runtime's Unicode data - Compatibility risk suite13 deterministic cases
tests/compatibility.test.mjs checks that bidirectional controls, invisible characters, mixed scripts, and NFKC-changing input raise the documented risk status, and that safe-text stripping preserves ordinary content.
Run in: node --test, deterministic analyzer
Standards this tool follows
- UTS #39: Unicode Security Mechanisms
Confusable and mixed-script detection methodology.
- UAX #9: Unicode Bidirectional Algorithm
Bidirectional control characters flagged during inspection.
- UAX #15: Unicode Normalization Forms
NFC/NFKC normalization comparisons.
- RFC 3629: UTF-8
Byte-length counting for the UTF-8 encoding.