Punycode Converter

Punycode is a way to represent Unicode characters using only the limited ASCII set that the Domain Name System allows. Domain names can technically only contain letters a to z, digits, and hyphens, so a domain with accented or non-Latin characters like münchen.de is encoded into an ASCII string that starts with the prefix xn--, in this case xn--mnchen-3ya.de. Browsers display the friendly Unicode version to users but send the punycode version over the network.

An IDN is a domain name that contains characters outside the basic Latin alphabet, such as accents (café.fr), non-Latin scripts (例え.jp, мойсайт.рф), or emoji in some registries. IDNs let people register and use domains in their own language and script. Under the hood, every IDN is converted to punycode for DNS, which is exactly what this tool does and undoes.

Paste the Unicode domain (for example münchen.de or 日本.jp) into the converter and it instantly produces the ASCII punycode form (xn--mnchen-3ya.de). The tool detects which direction you need automatically: if you paste Unicode it encodes to punycode, and if you paste an xn-- domain it decodes back to readable Unicode. It converts each label of the domain separately, exactly as the DNS standard requires.

Paste the xn-- domain (for example xn--80ak6aa92e.com) into the box and the tool decodes it to its Unicode form. This is useful when you see a punycode domain in an email header, a security log, a certificate, or a browser address bar and want to know what it actually says. Decoding is the single best way to reveal a disguised lookalike domain.

A homograph attack uses characters from other scripts that look identical to Latin letters to register a domain that visually impersonates a real one. For example, the Cyrillic letter а looks exactly like the Latin a, so аpple.com (with a Cyrillic first letter) can masquerade as apple.com. Because the two are different at the byte level, they are different domains. Decoding a suspicious domain to its punycode and Unicode forms reveals the trick: a legitimate domain stays plain ASCII, while a spoof shows an xn-- form full of unexpected scripts.

Yes. Paste any domain you are unsure about. If it is a normal ASCII domain, the converter shows it unchanged. If it secretly contains non-Latin characters, the tool reveals the xn-- punycode and flags that mixed or non-Latin scripts are present, which is a strong phishing signal. Pair it with our short link safety checker when the suspicious domain sits behind a shortened link.

Yes. You can paste a whole URL like https://münchen.de/page?x=1 and the tool converts only the hostname, leaving the path and query string untouched, then shows you the fully converted URL. You can also paste just the bare domain. Either way, only the host portion is ever encoded, because punycode applies to domain labels and never to the rest of a URL.

Yes, entirely. The punycode encode and decode algorithm (RFC 3492) runs in client-side JavaScript, so nothing you paste is sent to or stored on our servers. You can safely check internal hostnames, unreleased domains, or suspicious links from a security investigation without anything leaving your device.

Punycode encodes the entire set of non-ASCII characters in a label into a compact suffix after a hyphen, so the result rarely resembles the original letter by letter. For example, münchen becomes mnchen-3ya: the basic ASCII letters are kept, the non-ASCII ü is removed from its position, and a coded sequence (3ya) at the end records where it goes and what it is. This is normal and reversible: decoding restores the exact original.

It depends on the registry and the script. Most modern browsers display the Unicode form for domains whose script matches the user's languages or the top-level domain's rules, and fall back to showing the raw xn-- punycode when a domain mixes scripts in a way that looks like a spoofing attempt. That fallback is a built-in anti-phishing defense. This tool always shows you both forms so you are never guessing.

Yes, where the registry allowed them. Some top-level domains historically permitted emoji in domain names, and those are encoded to punycode just like any other non-ASCII character. Paste the emoji domain and the tool returns the xn-- form, or paste the xn-- form to see the emoji it represents. Note that most major registries no longer accept new emoji registrations.

No, they solve different problems in different parts of a URL. Punycode applies only to the domain name (the host) and encodes Unicode into the DNS-safe ASCII a to z, 0 to 9, and hyphen set. Percent encoding (URL encoding) applies to the path, query string, and fragment and encodes unsafe characters as %XX sequences. If you need to encode the path or query portion of a URL, use our URL encoder and decoder instead.