Inspect

What is loaded above

That looks like a link to a well-known domain. It is not. The report decodes the Punycode label and shows the name it renders as in a browser address bar, then names each Cyrillic letter drawn to look like a Latin one.

This is the form the address actually takes in a link, a log line or a mail header, and it is the form that reads as harmless.

What it looks for

Text that is present but invisible. The Unicode tag block can carry an entire sentence in code points no font draws. Runs of zero-width characters can encode bytes as ones and zeros. Variation selectors can hang arbitrary data off a single emoji. All three are decoded and the hidden message is shown.

Characters that reorder what you see. Direction controls make a line render in one order while it is stored in another, which is the Trojan Source class of vulnerability. The report shows the order the text is actually stored in, which is the order a compiler or a parser reads.

Names that are not what they appear to be. Lookalike letters from Cyrillic, Greek and Armenian, whole domain labels that mix scripts, and Punycode decoded back to what it renders as.

Encodings, including layered ones. Base64, hex, Base32, URL encoding, HTML entities, data URIs and PEM blocks, each with a stated confidence and the reason for it. JSON Web Tokens are decoded and shown, with the signature explicitly not verified. File signatures such as gzip, PNG and ZIP are identified in the input or in whatever it decodes to, and a payload wrapped twice is followed one layer further.

Things that suggest something is off. Shannon entropy with a plain reading of what the number means, whether Unicode normalization would change the text, and whether any bytes were not valid UTF-8.

What it does not do

It reports what is present. It does not tell you whether to trust something, and it does not use alarming language, because the judgment is yours and the context is yours.

It does not verify signatures, decompress archives, or comment on URL structure. A report that finds nothing says so in one line rather than printing empty headings.

When to use it

Before acting on text someone sent you. Reviewing a pull request or a document you did not write. Working out why two strings that look identical are not equal. Checking a link before following it. Triaging anything that simply feels wrong.

Related

Invisible characters strips what this finds. Unicode code points gives the exact identity of every character.