# Punycode (IDN) Decoder

> Convert xn-- Punycode domain labels back into readable Unicode domain names.

- Page: https://decoder.tools/punycode-decoder
- Category: Data, Radix & String
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A Punycode decoder converts the ASCII form of an internationalized domain name, the labels starting with `xn--`, back into its Unicode spelling. `xn--mnchen-3ya.de` is `münchen.de`.

## Example

```text Input
xn--mnchen-3ya.de
```

```text Output
münchen.de
```

Labels that don't start with `xn--` are left unchanged, so you can paste a full domain name.

## What is Punycode?

The DNS only supports the letters `a–z`, digits and hyphens. To allow domains in other scripts, IDNA (Internationalized Domain Names in Applications) converts each Unicode label into ASCII with Punycode (RFC 3492) and adds the prefix `xn--`. Browsers show the Unicode form in the address bar, but certificates, DNS records, email headers and logs store the `xn--` form.

The encoding has two parts. All the ASCII letters of the label come first (`mnchen`), then a hyphen, then a compact code (`3ya`) that says which non-ASCII characters to insert and where.

## Look-alike (homograph) domains

Punycode matters for security. Attackers register domains that look like a well-known brand but use characters from another script, such as a Cyrillic `а` in place of the Latin `a`. In the address bar the two can look identical. The `xn--` form gives it away. If a domain you expected to be plain ASCII has an `xn--` label, decode it here and look closely at the result.

## How to use the Punycode decoder

1. Paste a domain name or a single label, for example `xn--bcher-kva.example`.
2. Read the Unicode version. Each `xn--` label is decoded separately.
3. To check for hidden look-alike characters in the result, paste it into the [Hexdump viewer](/hexdump-parser).

## Decode Punycode in code

```python Python
print("xn--mnchen-3ya.de".encode("ascii").decode("idna"))  # münchen.de
```

```js JavaScript (Node.js)
import { domainToUnicode } from "node:url";
console.log(domainToUnicode("xn--mnchen-3ya.de")); // münchen.de
```

## Punycode at a glance

| | |
|---|---|
| Specification | RFC 3492 (Punycode), RFC 5890–5894 (IDNA 2008) |
| Prefix | `xn--` (the ACE prefix) |
| Allowed output characters | `a–z`, `0–9`, `-` |
| Maximum label length | 63 characters after encoding |

## FAQ

### What does xn-- mean in a domain name?

It marks the label as Punycode. Everything after `xn--` is the encoded form of a Unicode label, which browsers usually display in its original script.

### Is Punycode used for email addresses?

The domain part of an email address can be Punycode, for example `user@xn--mnchen-3ya.de`. The part before the `@` uses a different mechanism (SMTPUTF8), not Punycode.

### Why does my browser show xn-- instead of the real name?

Browsers fall back to the Punycode form when a domain mixes scripts in a suspicious way, which is a defence against look-alike domains. Seeing `xn--` in the address bar is a cue to double-check where you are.