Punycode / IDN Converter

Punycode / IDN Converter

DNS was designed in the 1980s around a strict rule: a domain label may only contain ASCII letters, digits and hyphens (the "LDH" rule). That made it impossible to register a domain using the letters of any other script — Cyrillic, Greek, Chinese, Arabic, or even accented Latin like "ü" — until Internationalized Domain Names (IDNA) introduced a workaround in the 2000s: encode the non-ASCII label into a plain-ASCII string using the Bootstring algorithm (RFC 3492), and prefix it with "xn--" so resolvers and registries can tell an encoded label apart from an ordinary one. The result, called Punycode, is what actually gets stored in DNS and sent over the wire — "bücher.de" becomes "xn--bcher-kva.de" — while every modern browser decodes it back to the readable form in the address bar (unless it looks suspicious — see the security note below).

Bootstring works by splitting a label's Unicode code points into two groups: any code points that are already plain ASCII get copied into the output verbatim, followed by a "-" delimiter; every remaining non-ASCII code point is then encoded, in order of appearance, as a sequence of base-36 digits (a-z, 0-9) that together describe both which code point it is and where it belongs in the string, using a running delta from the previous position. This tool implements that exact algorithm from the published specification — not a wrapped copy of a library — so it's transparent about exactly what it does and doesn't handle (see the scope note in the FAQ below).

Punycode has a well-known security angle worth understanding, not just converting: a homograph (or "IDN spoofing") attack registers a domain using look-alike characters from a different script — for example, Cyrillic "а" (U+0430) is visually identical to Latin "a" (U+0061) in most fonts, so "аpple.com" with a Cyrillic "а" can render pixel-for-pixel like "apple.com" while being a completely different domain underneath, encoded as its own distinct "xn--" string. Browsers mitigate this with their own additional heuristics (showing the raw "xn--" form instead of the decoded Unicode when a label mixes scripts in a suspicious way), which this tool deliberately does NOT replicate — it's a converter, not a security scanner. Treat "the domain looks right" as weaker evidence than a certificate check or a bookmarked link, especially for anything sensitive like a login page.

Scope, stated plainly: this tool implements RFC 3492 Bootstring — the code-point-to-digit transform for a single DNS label — but not the full IDNA2008/UTS-46 processing that real browsers layer on top and around it (Unicode case-folding, "nameprep" normalization, tables of disallowed code points, and bidirectional-text rules for right-to-left scripts). That means a label containing code points a strict IDNA implementation would reject may still round-trip cleanly here. That's an accepted, documented limitation of a focused converter tool, not a correctness bug in the Bootstring step itself — for registering a real domain, always go through your registrar's own validation.

Glossary

Punycode

The ASCII-only encoding (RFC 3492) that represents a Unicode domain label as a string DNS can carry, prefixed with "xn--".

IDN

Internationalized Domain Name — a domain name containing characters outside plain ASCII, made possible in DNS via Punycode encoding.

ACE prefix ("xn--")

The ASCII Compatible Encoding prefix that marks a DNS label as Punycode-encoded rather than a plain ASCII label that happens to start with those letters.

Bootstring

The general-purpose algorithm (RFC 3492) Punycode is a specific parameterization of — encodes a sequence of code points as a shorter, ASCII-only string.

Homograph attack

A phishing technique that registers a domain using look-alike characters from another script (e.g. Cyrillic "а" for Latin "a") so it visually resembles a legitimate domain.

DNS label

One dot-separated segment of a domain name (e.g. "bücher" and "de" in "bücher.de") — Punycode encoding is applied per label, not to the whole domain at once.

API equivalent

This tool has no API equivalent in our service — Punycode/IDN conversion isn't an IP-address fact, so there's nothing for our API to return here. The conversion above runs entirely on your device; nothing is ever sent anywhere. If you're looking for our IP-lookup API instead, it covers geolocation, ASN/network and threat/fraud data for an IP address:

Read the full API docs

Related tools

• All developer tools
• URL Encoder / Decoder
• Base64 Encoder / Decoder

Frequently asked questions

What is Punycode used for?

It lets a domain name contain non-ASCII characters (accented Latin, Cyrillic, CJK, etc.) while still being a valid, ASCII-only DNS label under the hood — the form actually stored and transmitted by DNS.

Why does an IDN domain start with "xn--"?

"xn--" is the ASCII Compatible Encoding (ACE) prefix — it tells resolvers and registries that everything after it is a Bootstring-encoded label, not a plain ASCII label that happens to start with those letters.

What is a homograph attack?

A phishing technique that registers a domain using characters from another script that look identical to a familiar one — e.g. Cyrillic "а" instead of Latin "a" — so the fake domain visually resembles the real one despite being a completely different Punycode-encoded string underneath.

Does this tool implement full IDNA2008/UTS-46 normalization?

No — only the RFC 3492 Bootstring algorithm itself, not the case-folding, nameprep, disallowed-codepoint tables and bidi rules real browsers layer on top. A label a strict IDNA implementation would reject may still round-trip here; always validate through your registrar when registering a real domain.

Is my domain sent to a server?

No — the entire conversion runs in your browser using a local implementation of the Bootstring algorithm. This page makes no network request to perform it.

Why did conversion fail?

Either a label was empty (e.g. two dots in a row), or, on ASCII→Unicode, the "xn--" label wasn't valid Punycode (a bad digit, a truncated encoding, or an internal value that overflowed) — both are treated as malformed input, not a tool error.