Polyglyph

Detects look-alike (homograph) domains and warns with a red frame, link marks and optional blocking

Polyglyph spots look-alike (homograph) domains and warns you before and after you open them. It catches domains that are nearly impossible to tell apart from the real one, such as paypa1.com (digit 1) or pаypal.com (Cyrillic а). ■ What it does • Puts a mark in front of suspicious links on any page (red triangle = danger, yellow circle = caution). Hover or focus the mark to see the domain and why it was flagged • If the page you opened is a look-alike, draws a red frame around the screen and shows a warning banner at the top • Tells you exactly which character is fake: its position, its script (Cyrillic, Greek, …) and the letter it imitates • Asks again before you type into a password field on a look-alike site • (Optional) Blocks navigation to suspicious domains before the page loads • Shows the verdict as a badge on the toolbar icon (green ✓ OK, red danger, yellow caution, grey ✓ allowed). Click it for details and the list of suspicious links • Lets you allow sites you trust (exclusion list), always behind a two-step confirmation so you cannot allow one by accident ■ Three levels • Danger: look-alikes of well-known sites, Latin mixed with Cyrillic/Greek and similar scripts, and labels made only of characters that pass for Latin letters • Caution: other domains with non-ASCII characters (often legitimate, such as 日本語.jp, so no strong warning) • Allowed: sites on your exclusion list Only the domain (host name) is checked. Paths and queries in other languages never trigger a warning. ■ How it decides It ships the official Unicode confusables data (UTS #39), reduces each domain to its visual "skeleton" and compares it with frequently targeted sites. Everything runs inside your browser. ■ Settings Block before loading, strict mode (treat caution as danger), red frame and banner, badge, link marks, warning color, frame animation time, exclusion list (export to and import from a text file) ■ Tamper resistance If a fake site removes, hides or covers the warning, Polyglyph detects it and puts the warning back; pages that keep removing it are blocked. The page cannot press the "allow" button for you. ■ Privacy No browsing history, input or page content is collected or sent anywhere. Polyglyph makes no network requests at all. It stores only your settings and exclusion list. ■ Languages 51 languages, following your browser's display language ■ Limitations • ASCII-only look-alikes are detected for about 90 frequently targeted sites • Tricks that put the real name in a subdomain (paypal.com.example.net) are out of scope • No tool catches every fake site. When in doubt, open the site from a bookmark or the official app Source code and bug reports: https://github.com/endofuzzy/Polyglyph Service names mentioned are trademarks of their respective owners. Polyglyph is not affiliated with them.