Turn xn-- domain labels back into readable Unicode, and flag mixed-script labels that may be homograph lookalike domains used in phishing.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
Reading an xn-- domain
Any label beginning xn-- is Punycode. Decoding shows the Unicode domain it represents, which is the fastest way to find out what a link in an email or a certificate actually points at.
Worked example
xn--mnchen-3ya.de → münchen.de xn--80ak6aa92e.com → аррӏе.com (Cyrillic, not "apple")
Why the second example matters
Those characters are Cyrillic. Rendered in a browser address bar they can be indistinguishable from the Latin word, which is the basis of homograph phishing. Decoding tells you which script each character belongs to rather than how it looks.
Where you meet xn--
Certificate subject names, mail headers, server logs and security tooling all record the ASCII form, so an unfamiliar xn-- string in a log is usually a perfectly ordinary international domain — and occasionally is not.
Limits
Decoding reveals the characters; judging whether a domain is legitimate is a separate question this tool does not answer. Everything is decoded in your browser.
How to use the Punycode Decoder
- Paste the ASCII domain containing xn-- labels.
- Click "Decode Punycode" to reveal the Unicode form.
- Read the notes carefully – a mixed-script label is flagged as a possible lookalike domain.
Frequently asked questions
Why does my browser show xn-- instead of the readable name?
Browsers deliberately display the raw form when a name looks risky – for instance when it mixes scripts, or uses a script the user has no configured language for. Showing Punycode is a defence against lookalike domains, not a rendering failure.
What is a homograph attack?
It is the use of characters that look identical to Latin ones – Cyrillic "а" against Latin "a", for example – to register a domain that appears legitimate. The decoded name looks right to a human but resolves somewhere else entirely. This tool flags labels that mix scripts, which is the usual signature.
A label starting with xn-- was left unchanged. Why?
Because it does not decode to a valid, canonical Punycode label. Rather than display a plausible-looking but meaningless result, the tool leaves it alone and explains the problem – a decoded fake would be worse than none.
Does a mixed-script warning mean the domain is malicious?
Not by itself. Legitimate names do sometimes mix scripts, particularly in multilingual regions. The warning means the name deserves a careful look before you trust it, not that it is proven hostile.
