Test yourself

Spot the lie.

Each item is a real string as your terminal, browser or code review would render it. Decide: is it honest, or is it lying to you? Then reveal the raw bytes. No score is sent anywhere; it is all in your browser.

6 items / homoglyphs / zero-width / bidi override

The quiz

Read what is shown. Choose. Reveal.

Item 1 / a link in an email

You are asked to log in here. Trust it?

https://exаmple.org/account/login

The a in example is U+0430 CYRILLIC SMALL LETTER A, a homoglyph of Latin a (U+0061). This is an internationalized-domain (IDN) spoof: the bytes are not example.org. A padlock and valid TLS certificate prove nothing here.

Item 2 / an install command

A README tells you to run this. Is it the package you think?

npm install express

A U+200B ZERO WIDTH SPACE sits between expr and ess. The package name is not express but express - a typosquat that is pixel-identical to the real thing and can be registered separately.

Item 3 / a downloaded file

Your downloads folder shows this. A document, right?

Downloaded: report‮cod.exe‬

A U+202E RIGHT-TO-LEFT OVERRIDE after report flips the display of cod.exe so it reads exe.doc. The real filename ends in .exe - an executable wearing a document's name.

Item 4 / a commit command

Honest, or hiding something?

git commit -m "fix typo in README"

Honest. Pure ASCII, nothing hidden - exactly what it looks like. Not everything is a trap, and a tool that cried wolf on this would be useless. The skill is telling this apart from items 1 to 3.

Item 5 / a repository URL

No Unicode this time. Still, look closely.

git clone https://github.com/exarnple/build-toolkit

Lying - with plain ASCII. exarnple is e-x-a-r-n-p-l-e: the r+n reads as m. Homoglyph attacks do not need Unicode; the human visual system does the work.

Item 6 / a deploy command

Last one. Honest, or lying?

scp deploy.tar.gz web01:/var/www/releases/

Honest. Plain ASCII path and host, exactly as shown. Two of six were clean on purpose: the point is not "everything lies", it is "you cannot tell by looking - you have to check the bytes".

0 / 6

0 of 6 answered

How to win every time

You cannot out-stare a homoglyph. Stop trying; check the bytes instead.

Every item above is caught the same way: run the text through a tool that shows what is really there instead of what it renders to. Paste any of them into the Analyze page to see the codepoints, or use unicode-show on the command line. The rule is small: never trust rendered text for a security decision - a filename, a URL, a diff, a pasted command - without surfacing its raw bytes first.