Punycode Converter — Convert Unicode Domains to xn-- ASCII and Back

What is Punycode?

Punycode is the encoding, defined in RFC 3492, that represents Unicode characters using only the ASCII characters allowed in DNS host names: letters, digits, and hyphens. It is what makes internationalized domain names (IDNs) work on infrastructure that predates them. When you register a domain like münchen.de, the registry actually stores xn--mnchen-3ya.de — the xn-- prefix marks a label as Punycode-encoded. Your browser shows the readable Unicode form in the address bar, but every DNS query, WHOIS record, and SSL certificate underneath uses the ASCII form. There are now IDN top-level domains across more than 20 scripts, so entire addresses — like москва.рф → xn--80adxhks.xn--p1ai — can be non-Latin end to end.

How Punycode Works

Domain labels are converted one at a time, not as a whole string. The algorithm copies any plain ASCII characters first, then appends a compact code that records which non-ASCII characters appear and where they belong, and finally adds the xn-- prefix. That is why a Punycode encoder changes only the affected labels: in 例え.jp, the label 例え becomes xn--r8jz45g while .jp stays untouched. The conversion is fully reversible — decoding an xn-- label restores the exact original Unicode — which is why a Punycode decoder can always tell you what a suspicious xn-- link really says. For email addresses, only the domain after the @ sign is converted; the mailbox name is left alone. Before encoding, this converter also applies the IDNA2008/UTS-46 mapping step browsers use — lowercasing, Unicode normalization, and rejection of characters not permitted in domain names — so its output matches what your browser address bar produces, including for uppercase or mixed-form input.

Why International Domains Use Punycode?

DNS was designed around ASCII long before the web went global, and rebuilding it for full Unicode was never realistic. Punycode bridges the two: Unicode on the surface for people, ASCII underneath for the infrastructure. That one design decision is what makes the following possible:

• Businesses can register domains in their customers' native script — Arabic, Cyrillic, Chinese, Devanagari, and dozens more
• Websites can use addresses that match how their local audience actually writes
• Email addresses can carry international characters in the domain
• Existing DNS servers, registrars, and certificate authorities keep working unchanged

Punycode Examples

Here is how common Unicode domains look after conversion. Paste any of them into the converter above to reproduce the result:

Punycode and Homograph Phishing

The same mechanism that enables multilingual domains also enables IDN homograph attacks. Characters from different scripts can look identical — a Cyrillic "а" renders exactly like a Latin "a" — so an attacker can register a lookalike of a trusted brand that only differs at the code-point level. The famous proof of concept, xn--pple-43d.com, displays as a well-known fruit-company domain in browsers that render the Unicode form. This is why security teams decode suspicious xn-- links before clicking, and why many browsers and mail filters deliberately display the raw Punycode when a domain mixes scripts. If a link in an email or log starts with xn--, paste it into the decoder above to see the characters it actually contains before you trust it.

How to Use This Punycode Converter

1. Paste your input into the matching box — Unicode text (IDN) on one side, xn-- Punycode on the other.
2. For bulk conversion, enter multiple domains or email addresses, one per line or separated by commas. Each item is converted independently.
3. Click the matching button — Convert to Punycode for the Unicode to Punycode direction, or Convert to Unicode for the Punycode to Unicode direction. If an item cannot be converted, it is flagged with an error in the output while the rest of the list still converts.
4. Use the swap button to reverse direction, and the copy button to grab the full result.