{"uid":"cap_Z5XckXSvrgK0LuTpwTfn9","slug":"name-safety-checker-idn-homograph-registrability-0e4daae6","name":"Name-Safety Checker (IDN / Homograph / Registrability)","description":"Check whether a candidate name or domain label is VALID, SAFELY DISTINGUISHABLE from look-alikes, and legal under a TLD's syntax rules -- computed offline from public Unicode and IANA tables. Returns: Unicode normalization (NFC/NFD/NFKC/NFKD and whether NFKC folding changes the label), a per-character breakdown with codepoint, name, script and general category, UTS #39 single-script/mixed-script analysis, HOMOGRAPH AND CONFUSABLE DETECTION against the Unicode confusables table with the offending characters named as witnesses, the UTS #39 skeleton and any ASCII string the label visually imitates, a same-script confusable neighbourhood of near-identical variants an attacker could register against you, IDNA2008 validity, punycode A-label encoding with a decode round-trip, and per-TLD checks: presence in the IANA root zone, 1-63 octet label length, LDH, leading/trailing hyphen, the reserved hyphen-3-4 rule with its xn-- carve-out, all-numeric labels, 255-octet FQDN length, and RFC 2606/6761 reserved names. EVERY RESPONSE REPORTS THE VERSION AND DATE OF EVERY TABLE CONSULTED -- Unicode UCD version, Scripts.txt version, confusables revision and date, IANA TLD list version and date -- because reference-data currency is the whole point: confusable tables and the root zone change, and a sealed sandbox cannot refresh them. Every response also carries an Ed25519-signed reproducibility receipt (input hash, output hash, table versions, timestamp). Free preview at /v1/preview: one name, same response shape, same signed receipt, no payment. THIS SERVICE DOES NOT TELL YOU WHETHER A NAME IS AVAILABLE OR REGISTERED. It performs no RDAP, WHOIS, DNS or registry lookup of any kind. It tells you whether a name is VALID, whether it is SAFELY DISTINGUISHABLE from look-alikes, and whether it satisfies the syntax and reserved-label rules of the TLD you name -- all computed offline from public Unicode and IANA tables. A name can pass every check here and already be registered. WHAT ELSE THIS DOES NOT DO, stated up front: (1) No registry, DNS, RDAP or WHOIS query is made at any point, so nothing here reflects who owns what. (2) It applies no trademark, brand or legal analysis -- a name can be technically safe and still infringe. (3) Confusability is judged against the Unicode confusables table, which is a published approximation of human visual confusion, not a rendering test in your font. (4) The same-script neighbourhood is capped and is a sample of nearby variants, never an exhaustive enumeration. (5) Registry-specific policies (per-TLD allowed script sets, premium or blocked lists, local presence rules) are NOT encoded -- only the syntax and reserved-label rules named above. (6) The signature proves origin and integrity, not correctness. (7) Answers are only as current as the table versions reported in every response.\n\nOperated by Oddments. Paid per call in USDC on Base via x402.","url":"https://oddments-s5.exe.xyz/v1/check","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","anyOf":[{"required":["name"]},{"required":["names"]}],"title":"NameCheckRequest","properties":{"tld":{"type":"string","description":"optional TLD, e.g. 'com' or 'xn--p1ai'. Supplying it enables the IANA-root, FQDN-length and reserved-label checks."},"name":{"type":"string","description":"a single candidate label; shorthand for names:[name]"},"names":{"type":"array","items":{"type":"string","maxLength":63},"maxItems":50,"minItems":1,"description":"candidate labels. A LABEL, not a full domain -- 'example', not 'example.com'."}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","title":"NameCheckResponse","properties":{"receipt":{"type":"object","description":"Ed25519 reproducibility receipt: 'input_sha256', 'output_sha256' (this body with 'receipt' removed), 'issued_at', engine table versions, 'key_id' and 'signature_b64'. Proves origin and integrity, not correctness."},"results":{"type":"array","items":{"type":"object","properties":{"idna":{"type":"object","description":"IDNA2008 result: 'valid', 'a_label' (the punycode A-label), 'round_trip' (that A-label decoded back) and 'error'. On an encoding failure 'valid' is false, 'error' carries the reason and the other two stay null; 'valid' is null if the idna library was unavailable."},"input":{"type":"string","description":"The candidate label exactly as supplied, before any normalization."},"checks":{"type":"array","items":{"type":"object"},"description":"Every check evaluated, in order: 'id', 'status' (one of 'satisfied', 'violated', 'warning', 'unmet', 'unavailable'), 'required' and 'observed'; some rows add evidence fields. The 'tld:*' rows appear only when 'tld' was supplied."},"scripts":{"type":"array","items":{"type":"string"},"description":"Every Unicode script name present in the label, sorted. 'Common', 'Inherited' and 'Unknown' are listed but never make a label mixed-script."},"summary":{"type":"object","description":"Counts over 'checks': 'checks_total', 'satisfied', 'violated', 'warnings', and 'failed_check_ids' -- the ids of the violated rows."},"verdict":{"enum":["safe","caution","unsafe"],"type":"string","description":"'unsafe' if any check is violated, else 'caution' if any is a warning, else 'safe'. Never a statement about availability."},"skeleton":{"type":"string","description":"UTS #39 skeleton: NFD, confusables mapped, NFD again. Two labels sharing a skeleton are confusable with each other."},"characters":{"type":"array","items":{"type":"object"},"description":"One row per character of the input, in order: 'char', 'codepoint' (U+XXXX), Unicode 'name', 'script' and general 'category'."},"mixed_script":{"type":"boolean","description":"True when more than one script remains after excluding 'Common', 'Inherited' and 'Unknown' (the UTS #39 single-script test)."},"normalization":{"type":"object","description":"The label under each Unicode normalization form -- keys 'nfc', 'nfd', 'nfkc', 'nfkd' -- plus 'is_nfc', true when the input was already NFC."},"confusable_characters":{"type":"array","items":{"type":"object"},"description":"The spoofing witnesses: non-ASCII characters mapping to something else in the UTS #39 confusables table, each with 'confusable_with', 'target_codepoints' and 'ascii_target'. ASCII-to-ASCII shapes such as m->rn are excluded here and never drive the verdict."},"confusable_neighbourhood":{"type":"array","items":{"type":"object"},"description":"Same-script near-identical variants an attacker could register: 'variant', the 'position' replaced, the 'replaced'/'with' codepoints, 'with_name' and 'script'. A capped sample (info.x-resource-caps neighbourhood_limit), never an exhaustive enumeration."}}},"description":"One analysis object per label, in the order the labels were supplied."},"reference_data":{"type":"object","description":"version and date of EVERY table consulted"},"availability_disclaimer":{"type":"string","description":"Fixed notice, identical on every response: no registry, RDAP, WHOIS or DNS lookup is made, so nothing here reports whether a name is registered or free."}}}}}}},"responseSchema":{"type":"json","example":{"receipt":{"algorithm":"Ed25519","input_sha256":"sha256 of your canonicalized request","output_sha256":"sha256 of this response with 'receipt' removed","signature_b64":"Ed25519 signature over the canonical signed_fields","receipt_version":"oddments-receipt/1"},"results":[{"tld":"com","idna":{"error":null,"valid":true,"a_label":"xn--pple-43d","round_trip":"аpple"},"input":"аpple","checks":[{"id":"confusable:ascii_homograph","status":"violated","observed":"skeleton 'apple' reduces to ASCII 'apple', which is NOT this label","required":"the label does not visually imitate a different ASCII string","skeleton":"apple","ascii_lookalike":"apple"},{"…":"14 further rows, one per check"}],"scripts":["Cyrillic","Latin"],"summary":{"violated":3,"warnings":0,"satisfied":12,"checks_total":15,"failed_check_ids":["script:single_script","confusable:no_confusable_characters","confusable:ascii_homograph"]},"verdict":"unsafe","skeleton":"apple","mixed_script":true,"verdict_meaning":"'safe' means every VALIDITY and DISTINGUISHABILITY check passed. It does NOT mean the name is available -- see availability_disclaimer.","confusable_characters":[{"char":"а","name":"CYRILLIC SMALL LETTER A","script":"Cyrillic","codepoint":"U+0430","ascii_target":true,"confusable_with":"a","target_codepoints":"U+0061"}],"confusable_neighbourhood":[{"with":"U+0061","script":"Latin","variant":"аpple","position":0,"replaced":"U+0430","with_name":"LATIN SMALL LETTER A"}]},{"input":"my-name","summary":{"violated":0,"failed_check_ids":[]},"verdict":"safe"},{"input":"раypal","verdict":"unsafe","skeleton":"paypal"}],"reference_data":{"iana_source":"data.iana.org/TLD/tlds-alpha-by-domain.txt","idna_library":"python idna (IDNA2008/UTS46)","iana_tld_count":1438,"scripts_source":"/usr/share/unicode/Scripts.txt","unicode_source":"python unicodedata (UCD 15.0.0)","unicode_version":"15.0.0","confusables_date":"2025-07-22, 05:49:37 GMT","no_registry_data":"No RDAP, WHOIS, DNS or availability source is consulted by this service, ever. Every field above is a static public table evaluated offline.","confusables_source":"UTS #39 confusables.txt, unicode.org/Public/security/latest","iana_tld_list_date":"Thu Aug  6 07:07:01 2026 UTC","confusables_entries":6565,"scripts_txt_version":"15.1.0","confusables_revision":"17.0.0","iana_tld_list_version":"2026080600"},"availability_disclaimer":"THIS SERVICE DOES NOT TELL YOU WHETHER A NAME IS AVAILABLE OR REGISTERED. It performs no RDAP, WHOIS, DNS or registry lookup of any kind. It tells you whether a name is VALID, whether it is SAFELY DISTINGUISHABLE from look-alikes, and whether it satisfies the syntax and reserved-label rules of the TLD you name -- all computed offline from public Unicode and IANA tables. A name can pass every check here and already be registered."}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_p9EbD4BU12Vv6YAfkvw2D","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a domain label or candidate name is Unicode-normalized, visually safe from homograph/confusable attacks, and syntactically valid under IDNA2008 and per-TLD rules — computed offline from public Unicode and IANA tables.","exampleAgentPrompt":"Can you check whether the label 'аpple' is safe to use under the .com TLD — specifically flag any confusable or homograph issues, show me the skeleton and ASCII lookalike, and tell me if it passes IDNA2008 validation?","exampleUseCases":[{"title":"Homograph attack detection for brand protection","prompt":"Someone registered what looks like 'paypal.com' but I suspect it uses Cyrillic characters — can you check whether that label visually imitates ASCII 'paypal', show me which characters are confusable, and flag whether it passes as a valid IDN under .com?"},{"title":"New product name domain safety audit","prompt":"We're launching a product called 'Façade' and want to register façade.io — can you validate that label under the .io TLD, tell me if Unicode normalization changes it, check for any confusable-character lookalikes, and give me the punycode A-label?"},{"title":"Security screening of user-submitted display names","prompt":"A user just signed up with the display name 'ɢoogle' — can you run it through a confusable and mixed-script check so I can see if it's impersonating a known brand, and tell me its UTS#39 skeleton and which characters are flagged?"}],"resultDescription":"A JSON object with: a per-label verdict ('safe' or 'unsafe'), a per-check breakdown (violated/satisfied/warning) covering IDNA2008 validity, punycode round-trip, UTS#39 single-script and mixed-script analysis, confusable characters with codepoints and names, the UTS#39 skeleton, any ASCII string the label visually imitates, a confusable neighbourhood of near-identical registrable variants, per-character script/category data, per-TLD syntax checks (length, LDH, hyphen rules, reserved labels), and reference metadata (Unicode version, IANA TLD count, confusables table date). No availability, WHOIS, or DNS data is included.","failureModes":["Malformed or empty label input returns a validation error","Label exceeds 63-octet limit triggers length check failure","Non-Unicode-encodable byte sequences may cause normalization errors","TLD not present in IANA root zone results in an unknown-TLD warning","Network or signing errors from the x402 payment layer may cause request failure","Truncated or very long inputs may be rejected if they exceed request size limits"],"whenToPreferThis":"Choose this endpoint when you need offline, deterministic Unicode safety analysis of domain labels or candidate names — especially for homograph/confusable attack detection, IDNA2008 compliance, punycode encoding, or per-TLD syntax validation. It is ideal for brand-protection pipelines, domain registration pre-checks, and security screening of user-submitted names. It does NOT perform DNS lookups, WHOIS queries, or domain availability checks, so prefer a live DNS/RDAP endpoint if you need availability or ownership data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T00:33:03.118Z","isFirstParty":false}