Unicode permits multiple representations of text that can look identical or become equivalent only after normalization. If validation and interpretation happen on opposite sides of that transformation, the same input can acquire a different security meaning.
This checker computes JavaScript's four standard normalization forms and lowercase mappings locally. When the entire input is a valid hostname, it also shows the URL standard's ASCII hostname serialization. Lowercase is not presented as full Unicode case folding.
A warning identifies the exact ASCII syntax introduced by compatibility normalization. It does not claim XSS, SQL injection, or authentication bypass without evidence that a downstream system normalizes and then interprets those characters.
Edge cases worth knowing
- Canonical composition
- An accented character can move between one composed code point and a base character plus combining mark while remaining canonically equivalent.
- Compatibility punctuation
- Small and fullwidth punctuation can become ASCII syntax under NFKC or NFKD; the checker reports the introduced character exactly.
- Locale-sensitive lowercase
- Turkish and Lithuanian mappings can differ from default lowercase. Application identifier policy must name the intended mapping rather than assume one universal result.
Common mistakes
- Calling JavaScript lowercase full Unicode case folding.
- Applying punycode to arbitrary text instead of complete domain labels.
- Treating any normalization change as a proven injection exploit.
- Normalizing after validation when interpretation uses the normalized value.