Hidden-character, bidi, confusable, script-mix, normalization and grapheme checks for text an agent is about to trust.
payments ON MAINNET (real money) · 8 live endpoints
| Endpoint | Price | What it answers |
|---|---|---|
GET /bidi-check | $0.02 | Detect Trojan Source bidi controls (CVE-2021-42574): overrides, isolates, unbalanced openers, stray closers, with positions. |
GET /confusables | $0.02 | UTS #39 skeleton and homoglyph check: which characters look like others, and whether two strings are confusable. |
GET /grapheme-count | $0.02 | Count grapheme clusters, code points, UTF-16 units and UTF-8 bytes of text, and list each cluster's code points. |
GET /hidden-characters | $0.02 | Scan text for zero-width, bidi, tag-block, variation-selector and other invisible characters, each with position and verdict. |
GET /normalize | $0.02 | Normalize text to NFC, NFD, NFKC and NFKD, show code points of each, and whether the text changed. |
GET /script-mix | $0.02 | List the Unicode scripts in text and its UTS #39 restriction level; flags mixed-script words such as Latin plus Cyrillic. |
GET /text-sanitize | $0.02 | Strip zero-width, bidi, tag, stray variation-selector and control characters; returns cleaned text and what was removed. |
GET /utf8-bytes | $0.02 | UTF-8 bytes of text, or validate a hex byte string as UTF-8 and name overlong, surrogate and truncated sequences. |
GET /catalog returns this list as JSON. Activity hub · uptime.
Computed locally on the text you send using Unicode data (Node ICU, Unicode 17 properties; confusables data UTS #39 version 18.0.0), provided as is. A clean result means only that the listed classes were not found, never that text is safe. Do not send secrets in a query string. Every paid response carries a disclaimer field.