Compare two addresses before you send

Nobody compares forty-two characters. People compare the first six and the last four, because that is what a wallet shows and what fits in a message. An attacker who generates addresses until one matches your head and tail has defeated that check for the cost of a dusting transaction, and the poisoned address is then sitting in your transaction history, one tap from being pasted into the next payment. Paste both strings here and the comparison is done character by character instead: same address, same address written in a different case, a matching head and tail with a different middle, or two plainly different addresses. It runs entirely in your browser, and the address you paste is never transmitted.

• Compared here: every character, aligned from both ends, with the differing positions named.
• Flagged separately: characters that are invisible on screen, and Latin look-alikes from other alphabets.
• Never sent anywhere: neither address leaves the page, so there is nothing for us to know or to leak.

An Ethereum address written in all lower case is the same address as its mixed-case form: EIP-55 puts a checksum in the capitalisation, and flattening the case removes the protection without changing where the funds go. This page says that in as many words rather than reporting a mismatch, because someone taught that a case difference is noise is exactly the person who will wave through a real one.

Wallets that flag look-alike addresses compare against your own transaction history. That works for an address you have paid before and does nothing for a counterparty you are paying for the first time - which is when the amount is usually largest and the pressure highest. Comparing what you pasted against what they actually sent you needs no history at all.

• Take the address from where it was sent to you, not from your transaction list.
• Check the middle, not the ends: the ends are what the attacker matched.
• If the two differ anywhere, stop. There is no small difference in an address.

Do the addresses I paste get sent anywhere?

No. Neither address is transmitted - the comparison is arithmetic on two strings, done on your device. You can confirm it in your browser tools with the network tab open.

The two look identical to me but the page says they differ. How?

Some characters are invisible, and some are impostors. A zero-width space renders as nothing at all, and a Cyrillic letter can render exactly like its Latin twin. The page names the position and the code point of each one it finds, so you can see what your eyes cannot.

Can this tell me whether an address belongs to who I think?

No, and nothing can from the address alone. This answers one question - are these two strings the same address - which is the question in front of you when you are about to paste one of them.