Skip to content
ToolBoxGeniehome

Punycode Converter

Developer Tools · By Sidhin · Added

DNS carries only letters, digits and hyphens, so a domain written in any other script travels as punycode with an xn-- prefix. Browsers show you one form and everything underneath shows the other, which is why the two are worth comparing rather than trusting.

Either form works — a Unicode domain is encoded, an xn-- domain is decoded.

Try:

How to use the punycode converter

  1. 1Paste a domain in either form — Unicode or xn--.
  2. 2Read both forms; each has its own copy button.
  3. 3Check the label table, which shows the length of each encoded label against the DNS limit.
  4. 4Look at the scripts column if the domain came from an email or a message rather than from you.

Examples

A German domain

Input
münchen.de
Result
xn--mnchen-3ya.de

A substituted character

Input
аpple.com, with a Cyrillic first letter
Result
xn--pple-43d.com — flagged as mixing writing systems

The two render identically; only the encoded form shows the difference.

About the punycode converter

How the encoding works

Punycode is an instance of a general algorithm called Bootstring, with parameters fixed for domain names: base 36, a bias that adapts as it goes, and a delimiter that separates the literal ASCII from the encoded remainder. The encoder walks the code points in ascending order, emitting the difference between each and the last as a variable-length number.

The adaptive bias is what makes it compact. A label whose non-ASCII characters are close together in Unicode — which is nearly every real word, since a language's letters sit in one block — encodes into very few digits, because each delta is small.

Where the two forms diverge in practice

A browser shows the Unicode form in the address bar, subject to its own rules about which scripts it will display — most refuse to render a mixed-script name and show the xn-- form instead, precisely because of the homograph problem.

Everything below the browser uses the encoded form: DNS records, TLS certificates, server logs, registrar invoices, email headers. When a certificate appears not to match a domain, or a log line does not match what was typed, this difference is usually why.

Frequently asked questions

What is the xn-- prefix for?
It marks a label as punycode-encoded so a resolver knows to decode it rather than treating it as a literal name. The prefix is called an ACE prefix, for ASCII Compatible Encoding, and it is what makes the encoding backwards compatible with every piece of software written before internationalised domains existed.
Why does the encoded form look nothing like the original?
Because punycode is not a character-by-character substitution. It emits the ASCII characters first, then encodes the positions and code points of everything else as a series of deltas in base 36. That is what keeps the result short — münchen.de encodes to just five extra characters — and it is why the output is unreadable by design.
What is a homograph attack?
Registering a domain in which one character is replaced by an identical-looking character from another script. Cyrillic а is drawn exactly like Latin a, so a substituted domain is visually indistinguishable while resolving somewhere else entirely. The encoded form is where the difference becomes visible, which is why this flags a label that mixes scripts — but a flag is not a verdict, and mixed scripts are legitimate in many languages.
Does this do the full IDNA processing?
No, and it says so rather than implying otherwise. It applies the punycode algorithm from RFC 3492 exactly, in both directions, and lowercases before encoding. What it does not do is the full IDNA mapping of compatibility characters and disallowed code points, which needs the Unicode mapping tables — several hundred kilobytes for a step that changes the answer only for unusual input.

Related tools