Punycode Converter

Convert internationalized domain names (IDN) to and from Punycode

What is Punycode?

Punycode is an encoding syntax used to represent Unicode characters within the limited character set (ASCII) allowed in domain names. It enables Internationalized Domain Names (IDN) that contain non-ASCII characters like ü, ñ, 中文, or العربية to work on the internet's domain name system (DNS).

This free online Punycode converter transforms Unicode domain names to their ASCII-compatible encoding (ACE) and back. Essential for developers, domain administrators, and anyone working with internationalized web addresses.

How Punycode Works

The xn-- Prefix

Punycode-encoded labels start with "xn--" to indicate they contain encoded Unicode characters. This prefix tells DNS resolvers to decode the label.

Encoding Process

ASCII characters are preserved. Non-ASCII characters are encoded using a bootstring algorithm that efficiently represents Unicode code points using only the characters a-z, 0-9, and hyphen.

Example
münchen → xn--mnchen-3ya
日本語 → xn--wgv71a119e

Common Use Cases

Domain Registration

Register domains with special characters. Registrars often require the Punycode version.

SSL Certificates

Configure SSL/TLS certificates for IDN domains using their Punycode representation.

DNS Configuration

Set up DNS records for internationalized domains in zone files and DNS management.

Security Analysis

Detect homograph attacks where similar-looking Unicode characters impersonate legitimate domains.

Security: IDN Homograph Attacks

Malicious actors can register domains using Unicode characters that look identical to ASCII letters. For example, Cyrillic "а" (U+0430) looks like Latin "a" (U+0061).

  • apple.com vs аррle.com (Cyrillic а, р, р)
  • Punycode reveals the difference: xn--pple-43d.com
  • Modern browsers show Punycode for mixed-script domains

Frequently Asked Questions

Why is Punycode needed?

The DNS system was designed before Unicode existed and only supports ASCII (a-z, 0-9, hyphen). Punycode bridges this gap, allowing domain names in any language.

Will browsers show Punycode or Unicode?

Browsers display Unicode for trusted scripts (e.g., Japanese on .jp domains) but show Punycode for suspicious mixed-script domains to prevent phishing.

Is Punycode an encryption?

No, Punycode is encoding, not encryption. It's a reversible transformation for compatibility, not security. Anyone can decode xn-- domains.