IDN Encode / Decode

A Punycode converter is a tool that translates internationalized domain names (IDNs) written in non-ASCII scripts into the ASCII-compatible encoding that DNS actually carries, and back again. The algorithm is defined in RFC 3492 . DNS was built for ASCII letters, digits, and hyphens, so any label containing Unicode is rewritten with the prefix xn-- followed by an encoded form that round-trips losslessly.

Domain owners, security analysts, and registrars use a Punycode converter to register IDNs, audit lookalike domains, and verify how a browser will render a hostname seen in logs or certificates.

Why use a Punycode converter?

• Register IDNs correctly. A domain like münchen.de must be submitted as xn--mnchen-3ya.de. Encoding it avoids registration errors.
• Spot homograph phishing. Attackers register names that look like real brands using Cyrillic or Greek lookalikes. Decoding the xn-- form reveals the actual script.
• Audit TLS certificates. Certificate transparency logs show hostnames in Punycode. Decoding confirms what the user sees in the address bar.
• Debug DNS issues. DNS resolvers operate on ASCII. Converting between views explains why a lookup succeeds or fails.
• Stay local with sensitive hostnames. The converter runs in your browser, so internal audits never touch a third-party service.

How to use the IDN / Punycode Converter

1. Pick To Punycode to encode a Unicode domain, or From Punycode to decode an xn-- form back to Unicode.
2. Paste the full domain into the input field on the left, including the TLD.
3. Read the converted form on the right; it updates as you type.
4. Copy the result with the output panel’s copy control.
5. Switch modes and paste the output back to verify the round trip matches your source.

How Punycode works

Punycode encodes each label of a domain name (the segments between dots) independently. Pure-ASCII labels pass through. Labels that contain any non-ASCII character are run through the Punycode algorithm and prefixed with xn-- to flag them as ACE (ASCII Compatible Encoding) labels.

The algorithm writes the basic ASCII characters first, then encodes the positions and code points of the Unicode characters as variable-length integers. Output uses only a-z, 0-9, and -.

Common IDN mappings

A full domain encodes label by label:

münchen.de        ->  xn--mnchen-3ya.de
日本.jp           ->  xn--wgv71a.jp
xn--caf-dma.com   ->  café.com

Common use cases

• Domain registration. Registrars require IDNs to be submitted in Punycode form.
• Phishing investigations. Security analysts decode hostnames from suspicious URLs to spot homograph attacks.
• TLS certificate review. Decoding xn-- Subject Alternative Names confirms which Unicode hostnames a cert covers.
• DNS troubleshooting. When dig returns no results, encoding the queried name confirms the right ASCII label.

Frequently asked questions

What is Punycode?

Punycode is a way to represent Unicode characters using only ASCII letters, digits, and hyphens. It is the encoding used by the DNS system to carry internationalized domain names. The encoded form is prefixed with xn--.

Why do domains need Punycode?

DNS labels were defined before Unicode and only allow ASCII. To support domain names in non-Latin scripts without changing the protocol, the IDNA standards encode the Unicode label as ASCII text using Punycode.

Is Punycode encryption?

No. Punycode is a deterministic encoding, fully reversible without a key. It exists for protocol compatibility, not for confidentiality.

What does xn-- mean?

xn-- is the ACE (ASCII Compatible Encoding) prefix that tells DNS clients and browsers, “this label is the Punycode form of an IDN.” Browsers detect the prefix and render the original Unicode in the address bar.

Why does my browser show xn-- instead of the Unicode form?

Major browsers display the ASCII form when the label mixes scripts that look alike (a homograph defense). If a domain uses Cyrillic letters that mimic Latin ones, you may see the xn-- form.

Does Punycode work for paths or query strings?

No. Punycode applies only to DNS labels in the hostname. Paths and query strings use percent-encoding instead. See the URL Encode / Decode tool for that.

Related tools

• Base64 Encoder / Decoder: Convert binary data to ASCII for transport.
• URL Encode / Decode: Percent-encode paths and query strings for safe URL use.
• JWT Decoder: Split a JWT into its header, payload, and signature.
• URL Parser: Break a URL into its scheme, host, path, query, and fragment.