decoder.tools

Punycode (IDN) Decoder

Convert xn-- Punycode domain labels back into readable Unicode domain names.

Data, Radix & StringFree
INPUT
OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

A Punycode decoder converts the ASCII form of an internationalized domain name, the labels starting with xn--, back into its Unicode spelling. xn--mnchen-3ya.de is münchen.de.

Example

Input
xn--mnchen-3ya.de
Output
münchen.de

Labels that don't start with xn-- are left unchanged, so you can paste a full domain name.

What is Punycode?

The DNS only supports the letters a–z, digits and hyphens. To allow domains in other scripts, IDNA (Internationalized Domain Names in Applications) converts each Unicode label into ASCII with Punycode (RFC 3492) and adds the prefix xn--. Browsers show the Unicode form in the address bar, but certificates, DNS records, email headers and logs store the xn-- form.

The encoding has two parts. All the ASCII letters of the label come first (mnchen), then a hyphen, then a compact code (3ya) that says which non-ASCII characters to insert and where.

Look-alike (homograph) domains

Punycode matters for security. Attackers register domains that look like a well-known brand but use characters from another script, such as a Cyrillic а in place of the Latin a. In the address bar the two can look identical. The xn-- form gives it away. If a domain you expected to be plain ASCII has an xn-- label, decode it here and look closely at the result.

How to use the Punycode decoder

  1. Paste a domain name or a single label, for example xn--bcher-kva.example.
  2. Read the Unicode version. Each xn-- label is decoded separately.
  3. To check for hidden look-alike characters in the result, paste it into the Hexdump viewer.

Decode Punycode in code

Python
print("xn--mnchen-3ya.de".encode("ascii").decode("idna"))  # münchen.de
JavaScript (Node.js)
import { domainToUnicode } from "node:url";
console.log(domainToUnicode("xn--mnchen-3ya.de")); // münchen.de

Punycode at a glance

SpecificationRFC 3492 (Punycode), RFC 5890–5894 (IDNA 2008)
Prefixxn-- (the ACE prefix)
Allowed output charactersa–z, 0–9, -
Maximum label length63 characters after encoding

Frequently asked questions

What does xn-- mean in a domain name?

It marks the label as Punycode. Everything after xn-- is the encoded form of a Unicode label, which browsers usually display in its original script.

Is Punycode used for email addresses?

The domain part of an email address can be Punycode, for example user@xn--mnchen-3ya.de. The part before the @ uses a different mechanism (SMTPUTF8), not Punycode.

Why does my browser show xn-- instead of the real name?

Browsers fall back to the Punycode form when a domain mixes scripts in a suspicious way, which is a defence against look-alike domains. Seeing xn-- in the address bar is a cue to double-check where you are.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown