What does xn-- mean in a domain name?

It is the ACE (ASCII Compatible Encoding) prefix that marks a label as Punycode-encoded. Everything after it is the encoded form of a Unicode label.

Why is Punycode a security concern?

Different Unicode characters can look identical on screen. An attacker can register a domain that renders like a familiar brand but resolves elsewhere. Decoding the xn-- form and inspecting the actual code points is how you catch it.

Is each part of the domain encoded separately?

Yes. Punycode operates per label, so only the labels containing non-ASCII characters get the xn-- prefix; the rest of the domain stays as-is.

Punycode (IDN) Decoder

Decode xn-- Punycode internationalized domain names back to Unicode.

live · client-sideData, Radix & Stringfree · no sign-up

RAW INPUT

DECODED

Output appears here as you type — decoded on your device.

Input is processed on your device. Nothing you paste is sent anywhere.

What is the Punycode (IDN) Decoder?

Punycode is an encoding that represents Unicode domain names using only ASCII letters, digits and hyphens, prefixed with xn--, so internationalized domains can travel through DNS infrastructure that only understands ASCII.

DNS was specified for a limited ASCII character set, but domain names are needed in every script on earth. IDNA solves this by converting each Unicode label to an ASCII form using Punycode (RFC 3492) and tagging it with the xn-- prefix: münchen.de becomes xn--mnchen-3ya.de. Browsers do this transparently, which is why you rarely see the encoded form until you look at a certificate, a log file or a raw DNS query.

Decoding Punycode is also a security task. Homograph attacks register domains whose Unicode characters render almost identically to a well-known brand — Cyrillic а for Latin a, for instance — and the only reliable way to tell them apart is to look at the xn-- form and decode it deliberately. This tool does that locally, so you can inspect a suspicious domain without resolving or visiting it.

Punycode (IDN) Decoder at a glance

Specification: RFC 3492 (Punycode) · RFC 5891 (IDNA2008)
Prefix: xn-- marks an encoded label
Scope: Per label — each dot-separated part is encoded separately
Security note: Reveals homograph / IDN spoofing domains

How to use the Punycode (IDN) Decoder

1Paste the domain, whether it is in xn-- form or already Unicode.
2Each label is converted and shown in both representations.
3Compare the Unicode form carefully against the brand it resembles before trusting it.

When you would reach for it

Checking whether a link in a phishing email uses a lookalike IDN domain.
Reading xn-- hostnames out of TLS certificates, DNS logs or WHOIS records.
Confirming how an internationalized domain will be stored and transmitted.

Punycode (IDN) Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools