Turn xn-- domain labels back into readable Unicode, and flag mixed-script labels that may be homograph lookalike domains used in phishing.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
How to use the Punycode Decoder
- Paste the ASCII domain containing xn-- labels.
- Click "Decode Punycode" to reveal the Unicode form.
- Read the notes carefully – a mixed-script label is flagged as a possible lookalike domain.
Frequently asked questions
Why does my browser show xn-- instead of the readable name?
Browsers deliberately display the raw form when a name looks risky – for instance when it mixes scripts, or uses a script the user has no configured language for. Showing Punycode is a defence against lookalike domains, not a rendering failure.
What is a homograph attack?
It is the use of characters that look identical to Latin ones – Cyrillic "а" against Latin "a", for example – to register a domain that appears legitimate. The decoded name looks right to a human but resolves somewhere else entirely. This tool flags labels that mix scripts, which is the usual signature.
A label starting with xn-- was left unchanged. Why?
Because it does not decode to a valid, canonical Punycode label. Rather than display a plausible-looking but meaningless result, the tool leaves it alone and explains the problem – a decoded fake would be worse than none.
Does a mixed-script warning mean the domain is malicious?
Not by itself. Legitimate names do sometimes mix scripts, particularly in multilingual regions. The warning means the name deserves a careful look before you trust it, not that it is proven hostile.
