Inspect a domain or URL
- Paste a Unicode domain such as
münchen.de, its ASCII formxn--mnchen-3ya.de, or an absolute URL. - Choose Convert. The tool detects the input form, so you don't need to choose an encoding direction. Conversion runs in your browser.
- Read the converted forms, then inspect the label and character details before using the result.
- Unicode form
- The readable spelling. For a full URL, conversion changes the hostname and preserves the other URL parts, subject to normal URL parsing and percent encoding.
- ASCII form
- The spelling used for DNS. If both forms look identical, there is only one value to copy. Use the form your next tool requires.
- Label breakdown
- Each row shows one hostname label, its Unicode and ASCII forms, writing systems, and encoded byte length. The whole-hostname count is separate from the per-label limit. Correct any validity findings even when conversion produced text.
- Character table
- For non-ASCII labels, this identifies each character by code point, Unicode name, and script. A mixed-script assessment is a reason to inspect the spelling, not proof of abuse. The absence of a warning does not establish safety.
What is punycode?
Punycode encodes Unicode text using ASCII characters. Internationalized domain names use it within a larger set of name-validation rules; a valid encoded domain label has an xn-- prefix. Not every Unicode string is a valid domain name.
So münchen.de travels across the internet as xn--mnchen-3ya.de. Same domain, two representations. A browser may display the readable name or keep the encoded form, depending on its display and security rules.
Why do domain names have two forms?
Internationalized hostnames need a representation compatible with existing hostname rules. Encoding each label gives software an ASCII name to resolve while people can use their own writing system. This concerns domain-name handling, not a claim that every DNS record is limited to those characters. RFC 5890 defines the Unicode and ASCII label forms.
What is a punycode phishing attack?
Some characters from different writing systems look alike. Latin a is U+0061; Cyrillic а is U+0430. A substituted character can change the name even when a link looks familiar. This example demonstrates the distinction; it makes no claim that a particular lookalike is valid, registered, or available.
These are called homograph attacks. Mixing writing systems inside one part of a name is the usual shape, so this tool flags that and lists the exact code points so you can see which character is doing the impersonating.
Be careful with the conclusion though. Plenty of legitimate names in multilingual regions mix scripts, and a name written entirely in Cyrillic is completely normal in a Cyrillic-speaking country. Mixed script is a reason to look closely, not a verdict.
What will this not catch?
Lookalikes built from ordinary ASCII. paypaI.com with a capital i, or rn standing in for m, are pure Latin characters and no script check will ever flag them.
No warning does not prove that a name is safe. The tool lists characters and flags supported script combinations; it does not compare every lookalike, inspect the website, or verify who sent you the link.
Browsers also make their own decisions about when to display a name readably and when to show the raw xn-- version. Those rules differ between Chrome, Firefox and Safari and change over time, so what your address bar shows may not match what is here.
Why is my converted domain name too long?
Each part of a domain has a hard limit of 63 bytes, and encoding inflates things. A handful of non-ASCII characters can easily triple in length, so a name that looks short in its readable form can exceed the limit once encoded.
The label breakdown shows the encoded byte count for each part. Check that count before treating a readable spelling as a usable hostname.
Does punycode apply to the whole URL?
No, only the domain name. The path and query string of a URL use percent encoding, which is a completely different mechanism that produces things like %20 for a space. If you paste a full address here, only its hostname is converted. The result keeps the other URL parts, subject to normal URL parsing and percent encoding.
Related tools
If a link looks wrong, converting it here shows the real characters. From there, the domain age checker will tell you how recently the name was registered, without treating age as proof of safety, and the domain registration lookup gives you the whole record.