Punycode / IDN Converter

Q: Why do domains start with xn--?

DNS resolves only ASCII letters, digits and hyphens — a rule decades older than Unicode. IDNA converts each non-ASCII label to punycode and stamps it with the ACE prefix xn--; RFC 5890 calls the result an A-label. Registries store that form; browsers translate it for display.

Q: Does this tool tell me a domain is safe?

No. It reports facts — per-label scripts, script mixing, invisible code points. Quiet is not clearance: an all-Cyrillic look-alike never mixes scripts, and catching it takes Unicode confusables data this page does not carry. Read the table as evidence, not a verdict.

Q: Punycode or percent-encoding — which one do I need?

Match the mechanism to the URL part: host names carry non-ASCII as punycode labels, while paths, queries and fragments carry bytes as %XX escapes. Percent signs want the URL decoder; accents or an xn-- prefix belong here. One address can need both.

Convert xn-- domains to Unicode and back, label by label, with mixed-script flags — entirely on this device.

0 bytes uploaded

Auto-detectDomain to convert

Converted domain

0 B · 0 lines

Convert a domain to see each label side by side — ACE form, Unicode form and every non-ASCII code point.

Flags mixed scripts and lists every non-ASCII code point. Not a full Unicode confusables audit — a quiet result is not proof a domain is safe.

Press ? for shortcuts

Do it offline:$ idn2 -d xn--mnchen-3ya.de

How to use it

Paste a domain or a whole URL — the host is kept, and a chip names which parts were dropped.
Read the direction badge: an xn-- label means Punycode → Unicode, non-ASCII means Unicode → punycode; click it or press s to override.
Copy the result or download it as a .txt file.
Scan the per-label table: ACE and Unicode forms, plus every non-ASCII code point with its U+ number and script.

Internationalized domain names lead a double life: DNS and registrars store an ASCII form whose converted labels begin with xn--, while browsers render the Unicode spelling. Paste either one — the direction is detected automatically, every label is converted in place, and a per-label table names the script of each non-ASCII code point, so the Cyrillic а in pаypal.com stops passing for its Latin twin.

How it works

A punycode payload packs two alphabets into one string: everything before the last hyphen is the label's plain-ASCII residue, copied verbatim, and the characters after it are base-36 deltas naming which code point to insert, and where. RFC 3492 calls the scheme Bootstring — münchen compresses to mnchen plus the tail 3ya.

The directions run on different machinery: decoding uses this page's own RFC 3492 decoder, which refuses malformed payloads with a position-anchored error, while encoding hands the whole domain to the browser's URL host parser — the UTS #46 IDNA mapping address bars apply. Underscores survive, 𝕕𝕠𝕞𝕒𝕚𝕟 becomes domain, and ß stays rather than expanding to ss.

Decodes are checked backward too: the result is re-encoded through that same native path, and a warning prints both forms whenever the round trip disagrees with the paste.

Examples

münchen.de

xn--mnchen-3ya.de

The table lists ü as U+00FC, Latin; the ACE form spells the residue mnchen, then the tail 3ya that positions it.

xn--wgv71a119e.jp

日本語.jp

Three Han code points (U+65E5, U+672C, U+8A9E) unpack from the ten-character payload wgv71a119e; the jp label is already ASCII and rides through untouched.

pаypal.com

xn--pypal-4ve.com

The second letter is Cyrillic а (U+0430), and the chip fires in both directions: "Label 1 ('pаypal') mixes Latin and Cyrillic characters in one label — a common look-alike pattern; check it carefully."

XN--MNCHEN-3YA.DE

münchen.de

Shouted ACE from a log file still decodes; a chip explains: "Uppercase letters were folded to lowercase — DNS names and punycode are case-insensitive."

Every example on this page is executed against the same engine that powers the tool, on every build.

Gotchas worth knowing

xn--abc- decodes, with a warning

Raw RFC 3492 turns xn--abc- into abc, yet no conforming encoder produces that label — plain ASCII needs no prefix. This page decodes it and warns, printing both forms; browser-grade IDNA rejects it outright.

Invisible code points are flagged

xn--ngb3d845h.com decodes with a zero-width non-joiner (U+200C) between Arabic letters; the table marks the row invisible and the warning spells it out. A glyphless character makes two different domains look identical.

One script can still lie

аррӏе is Cyrillic from first to last, so the mixed-script flag stays quiet — the tell is the script column reading Cyrillic where Latin was expected. This is not a Unicode confusables audit; single-script look-alikes are out of scope.

The 63-octet label ceiling

Longer ACE labels cannot exist in real DNS; the converter still shows the result, and a warning states the octet count beside the limit.

Trailing root dots are legal

münchen.de. is the fully-qualified spelling — the final dot is preserved, never counted as an empty label. Interior double dots differ: a..b is refused at the dot's exact position.

IP literals pass through

192.168.0.1 and bracketed IPv6 literals are numbers, not names; a note says so and the address passes through unchanged.

Common errors

Invalid punycode in label 1: character '!' at position 6 is not a base-36 digit — punycode digits are a-z and 0-9.: Punycode payloads use only a-z and 0-9; a stray character usually means the label was wrapped, truncated or pasted with a footnote marker. The position marks the first offender.
This host was rejected by the IDNA encoder — the URL parser reported: Invalid URL: Encoding runs through the platform's URL parser, which disallows some inputs outright — a joiner with no context, or a U+FFFD from a botched copy. The words after reported: are the parser's own.
Invalid host: character '%' at position 2 looks like a percent-escape — decode the text first with the URL decoder (/url-decode), then convert it here.: Percent triplets such as %C3%BC belong in paths and queries, never in host names — converting one would encode the escape, not the character it stands for.
Input is larger than the 16 KB limit for this tool. For batch conversion use the CLI: idn2 -d < domains.txt: One domain at a time: hosts top out at 253 octets, so 16 KB absorbs any pasted URL. For a file of names, idn2 streams standard input.

FAQ

Why do domains start with xn--?