Unicode Inspector

How it works

Breaks text into code points with U+ value, name, general category, script and UTF-8/UTF-16 encoding; counts graphemes; compares NFC/NFD/NFKC/NFKD forms; and flags zero-width and invisible characters, bidirectional controls (Trojan Source) and mixed-script look-alike words used in phishing.

• The text is split into Unicode code points. General category and script come from the JavaScript regular-expression Unicode property tables of the server (\p{gc=…}, \p{Script=…}), which follow the Unicode version of its ICU build.
• Names: the complete Unicode name list is about 2 MB, so a compact built-in table covers ASCII, Latin-1, basic Greek and Cyrillic, all invisible/format/space characters, common punctuation and variation selectors; CJK ideographs, Hangul syllables, fullwidth forms and tag characters are named algorithmically. Other characters show no name.
• Grapheme clusters (user-perceived characters) are counted with Intl.Segmenter. Normalization forms come from String.prototype.normalize.
• Invisible: zero-width characters, format characters (Cf), fillers, variation selectors and tag characters. Bidi controls (U+202A–202E, U+2066–2069) can make source code display differently from how it compiles (CVE-2021-42574, "Trojan Source").
• Look-alikes: words mixing scripts (e.g. Latin + Cyrillic) and characters from a curated subset of Unicode confusables.txt are flagged; the skeleton maps them to Latin for comparison. This is a subset, not the full UTS #39 algorithm.

Sources

• Unicode Standard Annex #44: Unicode Character Database (Unicode Consortium)
• Unicode Technical Standard #39: Unicode Security Mechanisms (confusables) (Unicode Consortium)
• Unicode Standard Annex #29: Text Segmentation (grapheme clusters) (Unicode Consortium)
• Trojan Source: Invisible Vulnerabilities (CVE-2021-42574) (Boucher & Anderson)