{"uid":"cap_kYQ79w4U8CiOtqdBxhQd5","slug":"name-safety-checker-idn-homograph-registrability-9fd6bcda","name":"Name-Safety Checker (IDN / Homograph / Registrability)","description":"Check whether a candidate name or domain label is VALID, SAFELY DISTINGUISHABLE from look-alikes, and legal under a TLD's syntax rules -- computed offline from public Unicode and IANA tables. Returns: Unicode normalization (NFC/NFD/NFKC/NFKD and whether NFKC folding changes the label), a per-character breakdown with codepoint, name, script and general category, UTS #39 single-script/mixed-script analysis, HOMOGRAPH AND CONFUSABLE DETECTION against the Unicode confusables table with the offending characters named as witnesses, the UTS #39 skeleton and any ASCII string the label visually imitates, a same-script confusable neighbourhood of near-identical variants an attacker could register against you, IDNA2008 validity, punycode A-label encoding with a decode round-trip, and per-TLD checks: presence in the IANA root zone, 1-63 octet label length, LDH, leading/trailing hyphen, the reserved hyphen-3-4 rule with its xn-- carve-out, all-numeric labels, 255-octet FQDN length, and RFC 2606/6761 reserved names. EVERY RESPONSE REPORTS THE VERSION AND DATE OF EVERY TABLE CONSULTED -- Unicode UCD version, Scripts.txt version, confusables revision and date, IANA TLD list version and date -- because reference-data currency is the whole point: confusable tables and the root zone change, and a sealed sandbox cannot refresh them. Every response also carries an Ed25519-signed reproducibility receipt (input hash, output hash, table versions, timestamp). Free preview at /v1/preview: one name, same response shape, same signed receipt, no payment. THIS SERVICE DOES NOT TELL YOU WHETHER A NAME IS AVAILABLE OR REGISTERED. It performs no RDAP, WHOIS, DNS or registry lookup of any kind. It tells you whether a name is VALID, whether it is SAFELY DISTINGUISHABLE from look-alikes, and whether it satisfies the syntax and reserved-label rules of the TLD you name -- all computed offline from public Unicode and IANA tables. A name can pass every check here and already be registered. WHAT ELSE THIS DOES NOT DO, stated up front: (1) No registry, DNS, RDAP or WHOIS query is made at any point, so nothing here reflects who owns what. (2) It applies no trademark, brand or legal analysis -- a name can be technically safe and still infringe. (3) Confusability is judged against the Unicode confusables table, which is a published approximation of human visual confusion, not a rendering test in your font. (4) The same-script neighbourhood is capped and is a sample of nearby variants, never an exhaustive enumeration. (5) Registry-specific policies (per-TLD allowed script sets, premium or blocked lists, local presence rules) are NOT encoded -- only the syntax and reserved-label rules named above. (6) The signature proves origin and integrity, not correctness. (7) Answers are only as current as the table versions reported in every response.\n\nOperated by Oddments. Paid per call in USDC on Base via x402.","url":"https://s5.oddments.ai/v1/check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","anyOf":[{"required":["name"]},{"required":["names"]}],"title":"NameCheckRequest","properties":{"tld":{"type":"string","description":"optional TLD, e.g. 'com' or 'xn--p1ai'. Supplying it enables the IANA-root, FQDN-length and reserved-label checks."},"name":{"type":"string","description":"a single candidate label; shorthand for names:[name]"},"names":{"type":"array","items":{"type":"string","maxLength":63},"maxItems":50,"minItems":1,"description":"candidate labels. A LABEL, not a full domain -- 'example', not 'example.com'."}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","title":"NameCheckResponse","properties":{"receipt":{"type":"object","description":"Ed25519 reproducibility receipt: 'input_sha256', 'output_sha256' (this body with 'receipt' removed), 'issued_at', engine table versions, 'key_id' and 'signature_b64'. Proves origin and integrity, not correctness."},"results":{"type":"array","items":{"type":"object","properties":{"idna":{"type":"object","description":"IDNA2008 result: 'valid', 'a_label' (the punycode A-label), 'round_trip' (that A-label decoded back) and 'error'. On an encoding failure 'valid' is false, 'error' carries the reason and the other two stay null; 'valid' is null if the idna library was unavailable."},"input":{"type":"string","description":"The candidate label exactly as supplied, before any normalization."},"checks":{"type":"array","items":{"type":"object"},"description":"Every check evaluated, in order: 'id', 'status' (one of 'satisfied', 'violated', 'warning', 'unmet', 'unavailable'), 'required' and 'observed'; some rows add evidence fields. The 'tld:*' rows appear only when 'tld' was supplied."},"scripts":{"type":"array","items":{"type":"string"},"description":"Every Unicode script name present in the label, sorted. 'Common', 'Inherited' and 'Unknown' are listed but never make a label mixed-script."},"summary":{"type":"object","description":"Counts over 'checks': 'checks_total', 'satisfied', 'violated', 'warnings', and 'failed_check_ids' -- the ids of the violated rows."},"verdict":{"enum":["safe","caution","unsafe"],"type":"string","description":"'unsafe' if any check is violated, else 'caution' if any is a warning, else 'safe'. Never a statement about availability."},"skeleton":{"type":"string","description":"UTS #39 skeleton: NFD, confusables mapped, NFD again. Two labels sharing a skeleton are confusable with each other."},"characters":{"type":"array","items":{"type":"object"},"description":"One row per character of the input, in order: 'char', 'codepoint' (U+XXXX), Unicode 'name', 'script' and general 'category'."},"mixed_script":{"type":"boolean","description":"True when more than one script remains after excluding 'Common', 'Inherited' and 'Unknown' (the UTS #39 single-script test)."},"normalization":{"type":"object","description":"The label under each Unicode normalization form -- keys 'nfc', 'nfd', 'nfkc', 'nfkd' -- plus 'is_nfc', true when the input was already NFC."},"confusable_characters":{"type":"array","items":{"type":"object"},"description":"The spoofing witnesses: non-ASCII characters mapping to something else in the UTS #39 confusables table, each with 'confusable_with', 'target_codepoints' and 'ascii_target'. ASCII-to-ASCII shapes such as m->rn are excluded here and never drive the verdict."},"confusable_neighbourhood":{"type":"array","items":{"type":"object"},"description":"Same-script near-identical variants an attacker could register: 'variant', the 'position' replaced, the 'replaced'/'with' codepoints, 'with_name' and 'script'. A capped sample (info.x-resource-caps neighbourhood_limit), never an exhaustive enumeration."}}},"description":"One analysis object per label, in the order the labels were supplied."},"reference_data":{"type":"object","description":"version and date of EVERY table consulted"},"availability_disclaimer":{"type":"string","description":"Fixed notice, identical on every response: no registry, RDAP, WHOIS or DNS lookup is made, so nothing here reports whether a name is registered or free."}}}}}}},"responseSchema":{"type":"json","example":{"receipt":{"algorithm":"Ed25519","input_sha256":"sha256 of your canonicalized request","output_sha256":"sha256 of this response with 'receipt' removed","signature_b64":"Ed25519 signature over the canonical signed_fields","receipt_version":"oddments-receipt/1"},"results":[{"tld":"com","idna":{"error":null,"valid":true,"a_label":"xn--pple-43d","round_trip":"аpple"},"input":"аpple","checks":[{"id":"confusable:ascii_homograph","status":"violated","observed":"skeleton 'apple' reduces to ASCII 'apple', which is NOT this label","required":"the label does not visually imitate a different ASCII string","skeleton":"apple","ascii_lookalike":"apple"},{"…":"14 further rows, one per check"}],"scripts":["Cyrillic","Latin"],"summary":{"violated":3,"warnings":0,"satisfied":12,"checks_total":15,"failed_check_ids":["script:single_script","confusable:no_confusable_characters","confusable:ascii_homograph"]},"verdict":"unsafe","skeleton":"apple","mixed_script":true,"verdict_meaning":"'safe' means every VALIDITY and DISTINGUISHABILITY check passed. It does NOT mean the name is available -- see availability_disclaimer.","confusable_characters":[{"char":"а","name":"CYRILLIC SMALL LETTER A","script":"Cyrillic","codepoint":"U+0430","ascii_target":true,"confusable_with":"a","target_codepoints":"U+0061"}],"confusable_neighbourhood":[{"with":"U+0061","script":"Latin","variant":"аpple","position":0,"replaced":"U+0430","with_name":"LATIN SMALL LETTER A"}]},{"input":"my-name","summary":{"violated":0,"failed_check_ids":[]},"verdict":"safe"},{"input":"раypal","verdict":"unsafe","skeleton":"paypal"}],"reference_data":{"iana_source":"data.iana.org/TLD/tlds-alpha-by-domain.txt","idna_library":"python idna (IDNA2008/UTS46)","iana_tld_count":1438,"scripts_source":"/usr/share/unicode/Scripts.txt","unicode_source":"python unicodedata (UCD 15.0.0)","unicode_version":"15.0.0","confusables_date":"2025-07-22, 05:49:37 GMT","no_registry_data":"No RDAP, WHOIS, DNS or availability source is consulted by this service, ever. Every field above is a static public table evaluated offline.","confusables_source":"UTS #39 confusables.txt, unicode.org/Public/security/latest","iana_tld_list_date":"Thu Aug  6 07:07:01 2026 UTC","confusables_entries":6565,"scripts_txt_version":"15.1.0","confusables_revision":"17.0.0","iana_tld_list_version":"2026080600"},"availability_disclaimer":"THIS SERVICE DOES NOT TELL YOU WHETHER A NAME IS AVAILABLE OR REGISTERED. It performs no RDAP, WHOIS, DNS or registry lookup of any kind. It tells you whether a name is VALID, whether it is SAFELY DISTINGUISHABLE from look-alikes, and whether it satisfies the syntax and reserved-label rules of the TLD you name -- all computed offline from public Unicode and IANA tables. A name can pass every check here and already be registered."}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_4wy5yJ_0LMlzCtwiQ6cf7","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes domain labels or names for Unicode normalization, homograph/confusable attacks, IDNA2008 validity, punycode encoding, and per-TLD syntax compliance — computed offline from public Unicode and IANA tables.","exampleAgentPrompt":"Can you check whether 'аpple.com' is safe to use — specifically whether it contains any confusable or homograph characters that could make it a phishing risk, and give me its punycode encoding and a breakdown of any suspicious Unicode codepoints?","exampleUseCases":[{"title":"Phishing domain detection for security team","prompt":"I got a report that users are being redirected to 'раypal.com' — can you check if that domain contains any homograph or confusable characters that make it look like paypal.com, and tell me which specific Unicode codepoints are the culprits?"},{"title":"Brand name IDN safety review before launch","prompt":"We're about to register 'mönеy.com' as our new brand domain — can you check if it's IDNA2008-valid, whether it passes all TLD syntax rules for .com, and whether there are any near-identical confusable variants an attacker could register against us?"},{"title":"Registrar validating user-submitted hostnames","prompt":"A user wants to add 'аdmіn.example.com' as a subdomain label — can you run a full Unicode normalization, script analysis, and confusable check on 'аdmіn' under the .com TLD so I know if it's safe to allow?"}],"resultDescription":"Returns a JSON object containing per-label results (one per TLD checked), each with: a safe/unsafe verdict, per-check pass/fail breakdown with IDs and reasons, Unicode normalization details, per-character codepoint/script/category breakdown, UTS#39 skeleton and ASCII lookalike string, detected confusable characters with named witnesses, a confusable neighbourhood of near-identical variants, IDNA2008 validity, punycode A-label and round-trip decode, and a summary count of violated/satisfied checks. Also includes reference_data showing Unicode version, IANA source, and confusables table date. Responses are signed with an Ed25519 receipt.","failureModes":["Label exceeds 63 octets — IDNA length check fails with specific error","Label fails IDNA2008 normalization — returns error in idna.error field","Invalid or unsupported TLD submitted — may return no per-TLD registry data","Malformed UTF-8 or non-Unicode input — request parsing error","Network or service unavailability — HTTP 5xx response","Payment not provided or invalid x402 header — payment required error (402)"],"whenToPreferThis":"Choose this endpoint when you need a comprehensive, offline, standards-grounded analysis of a domain label's Unicode safety — especially for detecting IDN homograph attacks, validating IDNA2008 compliance, computing UTS#39 skeletons, or auditing brand names before registration. It is distinctly more thorough than simple regex hostname validators or WHOIS-based tools because it covers confusable character detection, mixed-script analysis, per-TLD syntax rule enforcement, and produces a signed receipt. Prefer it over DNS/RDAP availability checkers when your goal is safety and distinguishability analysis, not availability lookup.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T14:26:47.734Z","isFirstParty":false,"canonicalSlug":"name-safety-checker-idn-homograph-registrability-9fd6bcda"}