Typosquatting is the practice of registering a domain one keystroke away from a real brand: a missing letter, two swapped letters, or a doubled letter, then using it for phishing or ad fraud. The defence is to find those variants before attackers do, check which are already taken, and register or monitor the dangerous ones. This generator produces the classic variant families from your domain: omissions, adjacent swaps, and character duplications. It generates names only; it does not check availability or register anything, so the next step is checking the shortlist with your registrar.
Quick Answer: Enter your domain and click Generate Variants to list omission, swap, and duplication typos.
Free Online Tool
Domain Typosquat Generator
Generate typo, omission, and character-swap variants of a domain for defensive registration checks.
How to Use the Domain Typosquat Generator
- Type your domain, such as example.com.
- Click Generate Variants.
- Review the omission variants first: these are the most commonly typed.
- Review the swap variants, then the duplication variants.
- Copy the shortlist and check availability at your registrar.
- Register or monitor the variants that could plausibly steal your traffic.
Key Features
- Generates omission variants: one letter removed at each position.
- Generates adjacent-swap variants: each neighbouring pair exchanged.
- Generates duplication variants: each letter doubled in turn.
- Deduplicates results and excludes the original domain.
- Works on any domain name and extension.
- Runs entirely in the browser; generated names are never sent anywhere.
What the Result Means
A long variant list does not mean all variants are dangerous. Omission and swap variants of short, common words are the highest risk, because users actually make those typos. Duplication variants matter less but still catch fast typists. Variants that spell a different real word deserve extra attention, because they look plausible in an email address. Use the list as a triage tool: check the variants a tired user could plausibly type, and do not try to register every theoretical permutation of a long name.
Worked Example
For example.com, the omission family includes exmple.com and exampl.com, the swap family includes exmaple.com and exapmle.com, and the duplication family includes exaample.com and examplee.com. A brand team would check exmple.com first, since dropping a vowel is the most common typing slip, then the swaps, and would treat any variant that is already registered by someone else as a potential phishing risk to investigate rather than a name to buy. The same shortlist should be checked as an email domain, because a phishing message from exmple.com looks convincing in an inbox even when the website itself draws little traffic.
Best Practices and Tips
- Prioritise variants of the brand part, not the extension: users mistype names more than TLDs.
- Check variants as email domains too, since phishing uses mail, not just the web.
- Monitor rather than register when a variant is low risk; registration costs add up.
- Re-run the generator after a rebrand, because the new name has a new typo surface.
- Watch for homoglyph variants too, but note this tool covers keyboard typos, not lookalike characters.
Common Mistakes to Avoid
- Trying to register every variant, which is expensive and unnecessary.
- Only checking the web, while phishing happens over email.
- Forgetting to check variants of subdomains used for login pages.
- Assuming a variant is safe because it is currently unregistered.
Frequently Asked Questions
What is typosquatting?
Registering a domain that differs from a real brand by a small typo, then using it to intercept traffic or run phishing.
Does this check if variants are available?
No. It generates candidate names only. Check availability with your registrar or an RDAP lookup.
Should I register all variants?
No. Register the plausible ones and monitor the rest; a long brand has hundreds of variants.
What about lookalike characters?
Homoglyphs, such as a Cyrillic letter that looks like a Latin one, are a separate attack and need a separate check.