Punycode Converter
Converted label by label, as the DNS requires.
xn--mnchen-3ya.de
The punycode converter turns an international domain name into its ASCII xn-- form and back. It also flags labels that mix writing systems, because that is the signature of a homograph attack. A Cyrillic "а" is visually identical to a Latin "a" but resolves to an entirely different domain.
How it works
DNS only carries a restricted ASCII set, so an international domain is encoded before it is looked up. Punycode, defined in RFC 3492, does this reversibly: it keeps the ASCII characters in place, then appends an encoding of where the non-ASCII characters belong.
- Each dot-separated label is converted independently. The dots and any all-ASCII labels are untouched.
- Within a label, the ASCII characters are emitted first, followed by a hyphen.
- The non-ASCII characters are encoded as a series of deltas describing which code point goes at which position.
- The result is prefixed with xn-- to mark it as an encoded label.
The encoding is why xn-- domains look like nonsense: the trailing characters are not letters at all but a compressed description of insertions.
Examples
A German domain
Domain
münchen.de
Direction
Unicode to punycode
Result
xn--mnchen-3ya.de
The ASCII letters "mnchen" survive in order, the hyphen separates them from the encoding, and 3ya describes where the ü belongs. The .de label is already ASCII and passes through unchanged.
Decoding back
Domain
xn--mnchen-3ya.de
Direction
Punycode to Unicode
Result
münchen.de
The conversion is fully reversible, which is the point. The DNS stores one form and the browser displays the other.
A mixed-script label
Domain
аpple.com, with a Cyrillic а
Result
Flagged as mixing scripts
The first character is Cyrillic U+0430, not Latin a. It renders identically and encodes to a completely different domain, which is exactly how homograph phishing works.
Frequently asked questions
What does the xn-- prefix mean?
It is the ACE prefix, ASCII Compatible Encoding, marking a label as punycode-encoded. Anything after it is not readable text but a compressed description of which non-ASCII characters go where, which is why xn--mnchen-3ya looks like nonsense.
What is a homograph attack?
Registering a domain that renders identically to a legitimate one by substituting characters from another script. Cyrillic а, е, о and р are visually indistinguishable from their Latin counterparts. Most browsers now display the punycode form when a domain mixes scripts, which is the defence, and why decoding an xn-- domain before trusting it is worth doing.
Why is each label converted separately?
Because the DNS treats labels as independent units and each is separately length-limited to 63 characters. Encoding the whole domain as one string would break lookup and could exceed that limit.
Does punycode encrypt anything?
No. It is a reversible encoding, not encryption. Anyone can decode it, which is exactly what this tool does. It exists to fit non-ASCII names into a protocol that predates Unicode.