confusing.pw

What It Is

confusing.pw describes itself as CPaaS, or Confusing Passwords as a Service. Its core idea is to replace a user-entered password with homoglyphs—characters that look similar but are different Unicode characters—to generate a “confused password.” The site’s tone is clearly tongue-in-cheek, and it explicitly notes that this is not a truly reliable guarantee.

Core Features and Developer Perspective

Functionally, it offers two ways to use the service: a web page input form and an API. The API returns a confused result by sending a POST JSON request containing a password field. The endpoint is hosted on AWS execute-api in the eu-west-1 region. The text does not mention support for any specific languages or frameworks, and there is no SDK; integration therefore has to be handled as a regular HTTP API. The service also emphasizes that generation is random, so the same password will usually not produce the same result. It also does not provide Unicode code points, which makes results difficult to reproduce or verify.

Pricing, Open Source, and Self-Hosting

The captured text does not provide any pricing, payment methods, account system, open-source license, or self-hosting option. There is also no formal API documentation covering authentication, rate limits, response formats, error codes, SLA, privacy policy, or similar details. For a developer tool, these omissions significantly limit its usability in production projects.

Pros and Cons

Its strengths are that the concept is easy to understand and the barrier to calling it is low. It is suitable for demonstrating the recognition risks introduced by Unicode homoglyphs, or as a counterexample in security training. The downsides are also obvious: the page warns that passwords “may or may not be sent elsewhere,” which is a serious risk for entering real passwords. At the same time, the code is described as buggy and may drop characters or change their order, while its randomness makes stable reproduction impossible. As such, it should not be treated as a password generator, password manager, or security component.

Who It’s For and Access from China

It is best suited to security research, classroom demos, developer toy projects, or as an example of why you should not give passwords to untrusted services. If you need real password management, choose mature tools such as Bitwarden, KeePass, or 1Password, or use standard encryption libraries and cloud KMS in development systems. The text does not provide information about access from mainland China. Since the endpoint is on AWS API Gateway, actual connectivity needs to be tested independently; payment information is also not disclosed.