UTS #39: Unicode Security Mechanisms

Unicode Technical Standard #39 defines mechanisms for reducing security risks caused by Unicode’s large and diverse character set, especially when people must distinguish identifiers such as usernames, account names, and web addresses. Although computers can tell apart any two character sequences, visually similar strings can mislead users into interacting with an impersonator. The standard therefore recommends limiting which characters identifiers may contain, without restricting those characters in ordinary text. Its profiles build on Unicode properties and normalization rules, identifying characters to allow or restrict and providing tailored guidance for general identifiers, internationalized domain names, and email addresses.

The standard also specifies ways to identify potentially deceptive similarities, including confusables within one script, across scripts, or between entire writing systems. Detection methods cover mixed-script identifiers, levels of script restriction, and mixtures of number systems. Implementations can adopt the specified profiles and detection behavior exactly, or modify them, but must document precisely which characters, mappings, or behaviors differ. The document further defines requirements for handling joining controls in context and supplies data files used by the profiles. Its overall approach combines character restrictions with detection, helping systems reduce spoofing opportunities while retaining support for legitimate writing systems and application needs.