Encoding
Punycode encode/decode
Encode internationalized domain names (IDN) with unicode characters into ASCII-compatible Punycode (xn--) and back.
The DNS system historically only supports ASCII characters, so domain names with Cyrillic, CJK, or other non-ASCII characters (IDN) are encoded as Punycode — an ASCII-compatible form prefixed with xn--. This tool encodes and decodes such domains.
How to use it
- Encode: enter a domain with Cyrillic or other Unicode characters (e.g. пример.рф) to get its ASCII form as xn--....
- Decode: paste a domain in xn--... form to see the original characters.
- Works on both a single domain label and a full multi-level domain name.
Common uses
- Checking what real domain is hiding behind a confusing xn--... string in an email or link.
- Registering or setting up DNS for a domain with national characters when the registrar requires an ASCII form.
- Spotting a homograph attack — a domain visually mimicking a known brand using characters from a different script.
Things to keep in mind
Visually similar characters from different scripts (like Cyrillic "а" and Latin "a") can form a domain that looks identical to a known brand — this is the basis of homograph phishing.
Not every browser shows decoded Unicode the same way: when a domain label mixes scripts, browsers often deliberately show the raw xn-- form as a warning sign.
Article about this tool: Punycode: how internationalized domains work in DNS
Frequently asked questions
What is Punycode used for?
Punycode encodes internationalized domain names containing non-ASCII characters (like münchen.de) into an ASCII-compatible form prefixed with xn--, since the DNS system only supports ASCII labels.
Why should I be careful with Punycode domains?
Punycode enables homograph attacks, where lookalike characters from other alphabets are used to register domains that look identical to a trusted one. If a domain shows an xn-- prefix, decode it here to see what it actually spells out.
Does this only work on full domain names?
You can encode or decode a single label or a full dotted domain — each label between dots is converted independently, with the xn-- prefix only added to labels that actually contain non-ASCII characters.
How can I tell that a link uses Punycode?
An encoded domain always has an xn-- prefix before each label containing non-ASCII characters. If you see a domain starting with xn-- in an address bar or email, that's a sign of IDN — worth checking what text is hiding behind the encoding.
Do all browsers show Cyrillic in the address bar the same way?
No. Some browsers only show decoded Unicode if every character in the domain belongs to a single alphabet, and when scripts are mixed (a sign of a homograph attack) they deliberately show the raw xn-- form instead of the original characters.