Punycode Converter

Punycode is an encoding defined in RFC 3492 that represents Unicode text using only ASCII letters, digits and hyphens. It is the mechanism behind internationalized domain names (IDNs): a domain like münchen.de is stored in the DNS as xn--mnchen-3ya.de. The xn-- prefix marks the label as Punycode-encoded (called an ACE label). Browsers decode it for display and encode it before doing a DNS lookup.

Paste the domain or text into the Converter tab above with the direction set to Unicode to Punycode (or Auto). For example, münchen.de becomes xn--mnchen-3ya.de. Each label of a domain is converted separately; labels that are already ASCII pass through unchanged.

Set the direction to Punycode to Unicode and paste the encoded form, for example xn--mnchen-3ya.de. The tool strips the xn-- prefix from each label and decodes it, returning münchen.de. Decoding is case-insensitive, so XN--MNCHEN-3YA works too.

Use URL mode in the Converter tab, or just paste the full URL — the tool detects it automatically. Only the hostname is converted; the scheme, port, path, query and fragment are left untouched. For example, https://münchen.de/path becomes https://xn--mnchen-3ya.de/path.

IDN stands for internationalized domain name: a domain containing non-ASCII characters such as ü, 中 or р. Because the DNS only understands ASCII, each non-ASCII label is Punycode-encoded and prefixed with xn-- (called an ACE label, for ASCII Compatible Encoding). So münchen.de is the human-readable IDN and xn--mnchen-3ya.de is the ACE form that actually travels over DNS.

An IDN homograph attack registers a domain that looks identical to a trusted one but uses lookalike characters from another script — for example, Cyrillic а (U+0430) instead of Latin a in paypal.com. The browser may display the Unicode form, hiding the spoof. Warning signs: a domain that mixes scripts (Latin plus Cyrillic or Greek), certificate or sender mismatches, and links arriving unexpectedly. Paste any suspicious domain into the Homograph Detector tab above to see every lookalike character, the scripts involved, and what the domain visually mimics.

In browsers and Node.js 10+, the built-in URL API handles domains: new URL('https://münchen.de').hostname returns 'xn--mnchen-3ya.de'. (The standalone punycode npm module is deprecated.) For raw Punycode without the IDN layer, this page's engine is a compact RFC 3492 implementation in plain JavaScript — the same code running in the converter above, verified against the RFC's own test vectors.

Python: 'münchen.de'.encode('idna').decode('ascii') gives 'xn--mnchen-3ya.de', and b'xn--mnchen-3ya.de'.decode('idna') decodes it back. Java: java.net.IDN.toASCII("münchen.de") and IDN.toUnicode(...). C#: new System.Globalization.IdnMapping().GetAscii("münchen.de") and GetUnicode(...). All three are built in — no packages needed.

The quickest cross-platform way is Python: python3 -c "print('münchen.de'.encode('idna').decode())". On Linux, the idn command (from libidn) also works: echo münchen.de | idn. On Windows PowerShell without Python, you can use .NET: [System.Globalization.IdnMapping]::new().GetAscii('münchen.de').

Excel has no built-in Punycode function. The practical options are: paste the values into the Batch tab of this converter and download the CSV, or use Power Query with a custom function. A VBA implementation is possible but long — for one-off conversions the batch tool here is faster and less error-prone.

Common causes: (1) the input is not valid Punycode — a truncated or mistyped xn-- label throws a decoding error; (2) you are decoding a label without the xn-- prefix, which the tool treats as plain text; (3) a single DNS label exceeds 63 characters after encoding (a hard DNS limit); (4) mixing up direction — make sure Unicode to Punycode vs Punycode to Unicode matches your input. The converter above reports the exact error instead of failing silently.

Yes — Punycode encodes any Unicode code point, so Hebrew (עברית → xn--5dbqzzah), Arabic, Chinese, Cyrillic and even emoji all work. The algorithm is script-agnostic: it only cares about code point values. Try the examples in the converter, e.g. 日本.jp or президент.рф.

This page is the tool — it runs entirely in your browser with no API, no app install and no download. Because there is no server involved, it also works offline once the page has loaded. If you were looking for a GitHub repository: there is none by design — the whole converter, RFC 3492 engine included, is a single self-contained page with no package or build step. If you need Punycode inside your own software, use the built-in IDN functions of your language (Python's idna codec, Java's IDN class, .NET's IdnMapping, or the URL API in JavaScript) rather than a web API.

Most online Punycode converters are a single input box with one-shot conversion and no explanation. This tool adds: bidirectional conversion with per-label breakdown, full-URL mode, batch conversion of up to 500 domains with CSV export, and an IDN homograph/phishing detector that flags lookalike characters (e.g. Cyrillic а vs Latin a) — plus a complete guide to Punycode, IDN and homograph attacks. See the comparison table above (checked October 2026).

Everything runs 100% in your browser. The page makes zero network requests after loading — no domain you paste, no conversion you run, ever leaves your device. There is no account, no signup, nothing stored and no analytics on your inputs. You can verify this in your browser's developer tools network panel.