Every string matcher on earth says rneta and meta are four edits apart. Every human reading a package list at 12px says they’re the same word. We measure the second one.
The merge holds below roughly 14px — terminal output, package manifests, sender lines, certificate subjects. Red marks the sizes where the eye stops resolving two glyphs.
Edit distance is the wrong ruler.
Levenshtein counts keystrokes. Attacks land on eyes. The two disagree most exactly where the danger is: the names your filters rank as safely different are the ones nobody can tell apart.
The four your matcher missed are the four you’d click. Visual distance is normalised pixel disagreement after rasterisation — 0.00 means two names that no reader can separate.
Five stages. They spell the name.
Confusable databases solve one-to-one glyph swaps. They cannot solve rn → m — a many-to-one merge that only exists once the text is drawn. So we draw it.
Rasterize every candidate across six faces at the sizes people actually read.
9–16px · hinting on
NFKC fold, case fold, UTS #39 skeleton. Catches single swaps; misses merges.
unicode 16.0
Perceptual hash plus a glyph-pair encoder that survives kerning and antialiasing.
128-d · cosine
Cutoffs per namespace. A registry tolerates less drift than a display name.
tuned per tenant
Webhook, SIEM event, or a pull request that pins the real package.
p95 · 40s
Wherever a name gets read by a person.
New publishes diffed against your dependency tree within a minute.
Certificate transparency streams, matched against your registered marks.
The header your staff sees, not the address your gateway checks.
Impersonated accounts inside the tools where people trust names by default.
Give us one name.
We’ll show you what’s already registered next to it.
First 500 names free. No agent, no DNS change.