Homoglyph

In orthography and typography, a homoglyph is a glyph that is used for either of a pair (or more) of distinct graphemes, or even a glyph whose shape appears identical or very similar to the glyph used for another grapheme. The designation is also applied to sequences of characters sharing these properties.

The homoglyphs
U+0061 a LATIN SMALL LETTER A and
U+0430 а CYRILLIC SMALL LETTER A overlaid. In the image, both characters are set in Helvetica LT Std Roman.

Examples of homoglyphic letters may be drawn from the Cyrillic and Latin alphabets. For example, a typical representative glyph for the Cyrillic letter Es is С, which is rarely distinguished from the glyph for the Latin letter C in the same typeface (or computer font). An extreme example is the hyphen-minus (-), which is widely used outside professional typography for any of hyphen, minus or en dash. Among digits and letters, the digit 1 (one) and the lowercase letter l ('ell') are always encoded separately but in many typefaces are given very similar glyphs. The same issue arises with the digit 0 (zero) and capital O ('oh'). Virtually every example of a homoglyphic pair of characters can potentially be differentiated graphically with clearly distinguishable glyphs and separate code points, but this is not always done. Typefaces that do not emphatically distinguish the one/el and zero/oh homoglyphs are considered unsuitable for writing formulas, network addresses, source code, IDs and other text where characters cannot always be differentiated without context.

In 2008, the Unicode Consortium published its Technical Report #36 on a range of issues deriving from the visual similarity of characters both in single scripts, and similarities between characters in different scripts.

Related terms

The term homograph is sometimes misused synonymously with homoglyph, but in the usual linguistic sense, homographs are words that are spelled the same but have different meanings, a property of words, not characters.

Allographs are typeface design variants that look different but mean the same thing – for example ⟨g⟩ and ⟨g⟩, or a dollar sign with one or two strokes. The term synoglyph has a similar but slightly more abstract meaning – for example the symbol ⟨£⟩ and the letter ⟨L⟩ (in Lsd) both mean the pound sterling, but only in that context. Allographs and synoglyphs are also known informally as display variants.

0 and O; 1, l and I

Two common and important sets of homoglyphs in use today are the digit zero ⟨0⟩ and the capital letter ⟨O⟩; and the digit one ⟨1⟩, the lowercase letter L ⟨l⟩ and the uppercase i ⟨I⟩. In the early days of mechanical typewriters it was common to omit keys for the digits ⟨1⟩ and ⟨0⟩, and the keys for the letters ⟨l⟩ and ⟨O⟩ produced glyphs used for both characters. As typists who had used such typewriters transitioned in the 1970s and 1980s to being computer keyboard operators, their old keyboarding habits continued with them and were an occasional source of confusion.

Most current type designs carefully distinguish between these homoglyphs, usually by drawing the digit zero narrower and drawing the digit one with prominent serifs. Early computer print-outs went even further and marked the zero with a slash or dot, which led to a new conflict involving the Scandinavian letter ⟨Ø⟩ and the Greek letter ⟨Φ⟩ (phi). Differentiating the design of the glyphs used for these graphemes has meant less risk of confusion.

Some type designs conform to the DIN 1450 legibility standard by carefully designing such characters to be easy to distinguish: slashed zero to distinguish it from capital ⟨O⟩; lowercase l with a tail and uppercase ⟨I⟩ with serifs to distinguish it from the digit ⟨1⟩; distinguishing the numeral ⟨5⟩ from the capital ⟨S⟩; etc.

An example of confusion due to near-homoglyphs arose from the use of a ⟨y⟩ to represent a ⟨þ⟩ (thorn). Early English typesetters imported Dutch typesets that did not contain the latter character, so used the letter ⟨y⟩ instead because (in Blackletter typeface) they look sufficiently similar. It has led in modern times to such phenomena as Ye olde shoppe, where the word the is written ye /jiː/ rather than þe because of this historic practice. The spelling of the name Menzies (pronounced Mengis and originally spelled Menȝies) arose for the same reason: the letter ⟨z⟩ was substituted for ⟨ȝ⟩ (yogh).

Multi-letter homoglyphs

The letter ⟨m⟩ and letters ⟨rn⟩ in typefaces Arial, Calibri, Times New Roman, Cambria, Walbaum-Fraktur, and Comic Sans

Stefan Szczotkowski looks like Aeffan Szczotkowski on the gravestone.

When some characters are placed next to each other, seen together at a glance they may give the visual impression of another, unrelated character. For instance, ⟨rn⟩ (lowercase RN) looks similar to ⟨m⟩ (lowercase M).

Canonicalization

Homoglyphs of all kinds can be detected through a process called 'dual canonicalization'. The first step in this process is to identify homoglyph sets, namely characters appearing the same to a given observer. From here, a single token is specified to represent the homoglyph set. This token is called a canon. The next step is to convert each character in the text to the corresponding canon in a process called canonicalization. If the canons of two runs of text are the same but the original text is different, then a homoglyph exists in the text.

Unicode homoglyphs

The three most prominent European alphabets (Greek, Cyrillic and Latin) share many letter forms that are encoded in Unicode under separate code points.

Unicode has code points for many strongly homoglyphic characters, known as "confusables". These present security risks in a variety of situations (addressed in UTR#36) and were called to particular attention in regard to internationalized domain names. In theory at least, one might deliberately spoof a domain name by replacing one character with its homoglyph, thus creating a second domain name, not readily distinguishable from the first, that can be exploited in phishing (see main article IDN homograph attack). In many typefaces, the Greek letter ⟨Α⟩, the Cyrillic letter ⟨А⟩ and the Latin letter ⟨A⟩ are visually identical, as are the Latin letter ⟨a⟩ and the Cyrillic letter ⟨а⟩ (the same can be applied to the Latin letters "aBceHKopTxy" and the Cyrillic letters "аВсеНКорТху"). A domain name can be spoofed simply by substituting one of these forms for another in a separately registered name. There are also many examples of near-homoglyphs within the same script such as ⟨í⟩ (with an acute accent) and ⟨i⟩ (with a tittle), ⟨É⟩ (E-acute) and ⟨Ė⟩ (⟨E⟩ with dot above) and ⟨È⟩ (E-grave), ⟨Í⟩ (capital ⟨I⟩ with an acute accent) and ⟨ĺ⟩ (lowercase ⟨L⟩ with acute accent). When discussing this specific security issue, any two sequences of similar characters may be assessed in terms of its potential to be taken as a homoglyph pair, or if the sequences clearly appear to be words, as pseudo-homographs (noting again that these terms may themselves cause confusion in other contexts). In the Chinese language, many simplified Chinese characters are homoglyphs of the corresponding traditional Chinese characters.

Efforts by TLD registries and Web browser designers aim to minimize the risks of homoglyphic confusion. Commonly, this is achieved by prohibiting names which mix character sets from multiple languages (toys-Я-us.org, using the Cyrillic letter ⟨Я⟩, would be invalid, but wíkipedia.org and wikipedia.org still exist as different websites); Canada's .ca registry goes one step further by requiring names which differ only in diacritics to have the same owner and same registrar. The handling of Chinese characters varies: in .org and .info registration of one variant renders the other unavailable to anyone, while in .biz the traditional and simplified versions of the same name are delivered as a two-domain bundle which both point to the same domain name server.

Relevant documentation will be found both on the developers' Web sites, and on an IDN Forum provided by ICANN.

ES1845 JCUKEN-QWERTY hybrid layout keyboard

The Cyrillic letter ⟨С⟩ (U+0421 С CYRILLIC CAPITAL LETTER ES) not only looks like Latin ⟨C⟩ (U+0043 C LATIN CAPITAL LETTER C), but also occupies the same button in JCUKEN-QWERTY hybrid layout keyboards. This design nuance can be seen on the C/С button represented in Keyboard Monument in Yekaterinburg.

See also

• IDN homograph attack – Visually similar letters in domain names
• Duplicate characters in Unicode – Unicode characters that have been encoded twice
• Vehicle registration plates of Bosnia and Herzegovina use only numbers and letters that look the same in the Latin and Cyrillic alphabets.
• Yaminjeongeum, South Korean language game of intentionally substituting Hangul characters for homoglyphs.

External links

• https://www.unicode.org/Public/security/latest/confusables.txt - recommended confusable mapping for IDN.