confusable-vision

The world's first font-by-font confusables dataset. Which Unicode characters look like which, measured from the fonts' outlines rather than from pixels. The current release, 2026.09.26, compares every letter and digit that each of 322 fonts draws, at the size and baseline position each glyph has in running text. The lookalikes of ASCII letters and digits are then checked in place: set between other letters in common fonts at the size people read them, and compared with pairs everyone accepts as alike, such as 0 and O.

addons.mozilla.org uses characters from confusable-vision to check add-on names for lookalikes, credited in Mozilla's source; see Used by.

Used by

• Mozilla addons-server, the code behind addons.mozilla.org, adds characters from confusable-vision's output to the table it uses to fold lookalikes to ASCII when checking add-on names: src/olympia/amo/confusables.py, pull requests #24468, #24541, #24612 and #24665 (February to March 2026).
• disarm (raeq/disarm), which canonicalises adversarial Unicode before it reaches classifiers, indexes and identifiers, adds measured pairs from confusable-vision to its confusables tables: data/confusables_supplement.tsv, data/confusables_vision.tsv.
• SilverSpeak (ACMCMC/silverspeak), a Python library for performing and neutralising homoglyph attacks on text, builds the visual neighbours in its homoglyph graph from confusable-vision's discovery files (docs/hkb.md).
• namespace-guard ships the measured pairs, and through it they reach agent-sanitizer, which uses namespace-guard as its default engine for folding lookalike characters in an AI agent's tool-call input to ASCII (deps.dev).

These projects took their data from confusable-vision's outputs of February and March 2026.

Discussed on Hacker News: I rendered 1,418 confusables over 230 fonts and Confusables.txt and NFKC disagree on 31 characters.

Release 2026.09.26 in figures:

• 322 fonts: every font on macOS, including those it downloads on demand such as PingFang, plus Roboto, Noto Sans, Noto Serif, Noto Sans CJK and DejaVu. 64,751 code points in 140 scripts.
• 11,517 pairs alike in at least one font or font combination, of which 5,975 pass the suggested thresholds.
• 719 pairs of a character and a two-letter ASCII sequence, such as ǁ and ll, or Ы and bl.
• 3,055 candidate lookalikes of ASCII letters, digits and sequences checked in place: 646 alike at the strict tier, 358 more at the broad tier, 101 more that match another common font's design of the letter. 224 of the strict ones are not in Unicode's confusables.txt.

The data is published as a versioned release in data/release/2026.09.26/ (CC-BY-4.0). namespace-guard and d0ma1n are built on it.

What changed from release 2

Release 2 (2026.09.24, and 2026.09.25 for the TLD data) compared only the pairs and fonts that earlier runs had compared. An audit of identical glyphs found it caught 637 of the 2,654 cases where a font draws two characters with the same glyph. Release 3 fixes that and adds three things:

• Coverage. Every letter and digit each font draws is compared with every other in that font, Han and Hangul included. Release 2 took its characters from a fixed list, so it never reached most of Yi, Canadian Aboriginal, Ethiopic or the Indic scripts, and it missed the script-only fonts and PingFang.
• The right faces. Font collections are loaded in the face a browser uses for body text. Earlier runs took the first face, which for some collections was bold, black or italic.
• Overlapping contours, as in variable fonts such as San Francisco, are measured as the union of their strokes, as a reader sees them.
• Two-letter sequences. Every sequence of two ASCII letters or digits (3,844) is set as each font sets it, with its kerning and ligatures, and compared like a character.
• The cross-font bar is set by the upper quartile of the page fonts, so adding fonts to the survey cannot move it.
• The in-place check (below).

The March 2026 figures (249,976 single-character pairs and 2,524,275 bigram pairs across 245 fonts) came from measurements that ignored size and baseline. They are superseded; the files from those runs stay in data/output/ for reference.

How it works

Measuring glyphs

RaySpace casts parallel rays through each glyph's outline at 36 angles, 50 rays each, and records five things per ray: how many times it crosses the outline, where, at what angle, how far it travels through ink each time (its ping, the stroke's width along the ray), and the widest gap between strokes. Each glyph is measured twice: in its own box, for shape, and in a fixed frame on the baseline, so size and position count. Two characters are alike in a font when the shape distance is below 0.5 and the baseline-anchored distance below 0.2. The comparison runs in Rust (native/cv-pairs), on every core.

• Within one font: every pair of letters and digits the font draws.
• Across fonts: a character in its own font, as a browser's fallback would draw it, against the 62 ASCII letters and digits of each of 26 page fonts that lack it. It counts when the ASCII letter is the nearest one, and the character is as close to it as that letter is to itself in the upper quartile of the other page fonts.
• Sequences: every character against the 3,844 two-character ASCII sequences, as each font sets them (Core Text; HarfBuzz sets them identically apart from the system font's tracking).

Checking in place

A lookalike measured in isolation can still stand out in a line of text. So every candidate lookalike of an ASCII letter, digit or sequence is set between neighbours (pa_nel, 20_5) in five contexts, the system font at 13 px and Helvetica, Arial, Times New Roman and Georgia at 16 px, each at a device pixel ratio of 1 and 2, with the platform's font fallback. Nothing is rescaled: the lookalike is compared where it lands in the line.

The bar in each context comes from pairs everyone accepts as alike, 0 and O, 1 and l, and I and l, counted only where that context draws them at the same size and position. A lookalike is: