IDN Punycode Converter
Convert between Unicode domain names and Punycode, and spot homograph attacks.
Last reviewed by the Radiatus Cloud team
Need this done properly for your business?
Radiatus delivers secure cloud, DevOps & compliance engineering.
DNS speaks ASCII only
The domain system accepts a restricted ASCII set, so a domain containing non-Latin characters is encoded into an ASCII form beginning xn--. München becomes xn--mnchen-3ya. The Unicode form is what a browser displays; the Punycode form is what is actually resolved and what appears in certificates and logs.
Homograph attacks exploit the gap
Cyrillic а, е and о are visually identical to their Latin counterparts. A domain using them renders as apple.com and resolves as something entirely different. Browsers defend by displaying the Punycode form when a label mixes scripts or uses a script inconsistent with the browser's locale, which is why a suspicious link sometimes appears as xn-- gibberish — that display is the warning, not a fault.
Encoding is per label
Each dot-separated label is converted independently, so only the labels containing non-ASCII get the xn-- prefix. A domain can mix encoded and plain labels, and a subdomain may be encoded while the parent is not.
Email addresses are a separate standard
Internationalised email uses SMTPUTF8 rather than Punycode for the local part, and support is inconsistent across providers. Punycode applies to the domain half; the part before the @ follows different rules and frequently fails silently.
Verifying a link
Converting a suspicious URL to Punycode reveals whether the visible characters are what they appear to be. A domain that looks entirely Latin but converts to an xn-- form contains non-Latin characters somewhere, which is decisive evidence.
Related tools
- User Agent Parser — Parse a User-Agent string into browser, engine, operating system and device. Explains why UA strings are unreliable and what to use instead.
- QR Code Generator — Generate QR codes for URLs, text, Wi-Fi and contact details. Adjustable error correction and size, produced entirely in your browser.
- Credit Card Validator — Validate a card number with the Luhn algorithm and identify the issuing network from its prefix. Runs locally, nothing is transmitted.
- Text Case Converter — Convert text between camelCase, PascalCase, snake_case, kebab-case, CONSTANT_CASE, Title Case and sentence case. Runs entirely in your browser.
Frequently Asked Questions
Why do some domains start with xn--?
Because DNS accepts only a restricted ASCII set, so non-Latin characters are encoded into Punycode. The Unicode form is displayed; the xn-- form is resolved.
What is a homograph attack?
Using visually identical characters from another script — Cyrillic а for Latin a — so a domain renders as a familiar brand while resolving somewhere else.
Why does my browser show xn-- instead of the real name?
It is a deliberate warning shown when a label mixes scripts or uses one inconsistent with your locale, to expose possible homograph spoofing.
Does Punycode apply to email addresses?
Only to the domain half. Internationalised local parts use SMTPUTF8, a separate standard with inconsistent provider support.
Privacy & Security
Runs in your browser. Nothing you enter is uploaded or stored.
About This Tool
This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
User Agent Parser
UtilityParse a User-Agent string into browser, engine, operating system and device. Explains why UA strings are unreliable and what to use instead.
QR Code Generator
UtilityGenerate QR codes for URLs, text, Wi-Fi and contact details. Adjustable error correction and size, produced entirely in your browser.
Credit Card Validator
UtilityValidate a card number with the Luhn algorithm and identify the issuing network from its prefix. Runs locally, nothing is transmitted.