3 Punycode Converters, Compared Honestly

A link in an email points at xn--80ak6aa92e.com. Your browser will happily render that as something that looks like apple.com, and the two are not the same site.

Punycode is the mechanism that lets domain names contain non-ASCII characters — genuinely useful for the majority of the world whose languages are not written in Latin script, and also the foundation of homograph attacks, where Cyrillic letters that look identical to Latin ones produce a convincing fake. Either way, you need to see what an xn-- label actually says.

How to judge a punycode converter

Which standard does it implement? IDNA2008 with UTS #46 compatibility processing is the modern combination. Older IDNA2003 behaviour differs on specific characters, and those differences are exactly where spoofing lives.

Does it handle a whole URL? A bare domain is the easy case. A full URL with a path needs the domain punycode-decoded and the path URL-decoded — two different operations.

Does the domain leave your browser? If you are inspecting a domain from a phishing email, sending it to a third-party server is a poor instinct.

Does it go both ways? Decoding tells you what a suspicious link says. Encoding is what you need when registering or configuring an internationalised domain of your own.

The comparison

Facts checked August 2026; tools change. Table covers only the 3 alternatives — our tool gets its own section below.

Punycoder

The most explicit about standards, which is the thing that separates a correct converter from an approximate one. It implements IDNA2008 with Unicode TR #46 compatibility processing — the modern standard, with the older IDNA2003 handling applied to characters where the two conflict. That is the right default, and stating it is rarer than it should be.

It also handles complete URLs properly: give it a URL with a protocol and it punycode-converts the domain while URL-encoding or decoding the path, which are genuinely separate transformations that many tools conflate. Free, no account. The page does not say whether conversion happens locally or on their server.

punycod.es

The one built for the security use case. Alongside Unicode, punycode and emoji domain conversion, it predicts how major browsers will display the name — which is the question you actually have when assessing a suspicious link, since browsers apply their own rules about when to show Unicode and when to fall back to the raw xn-- form.

It converts live as you type and states that everything runs in your browser, so the domain you enter is never sent to punycod.es or any other conversion service. Free, no account. It is domain-focused rather than built for long URLs with paths.

Prompt2Tool Punycode

The broadest on script coverage, supporting all Unicode languages and scripts including Arabic, Chinese, Japanese, Korean and Cyrillic. Conversion happens entirely in your browser using client-side JavaScript, with no domain data sent to their servers, and it is free with no registration and no stated usage limits.

Given a URL it converts only the domain portion, preserving the protocol and path untouched — the safer behaviour for most purposes, though different from Punycoder’s approach of also encoding the path. Worth knowing which you want before pasting a long URL into either.

Punycode to Unicode

Ours does the decoding direction specifically: punycode domains in, readable Unicode labels out, running entirely in the browser with no uploads, no account and no external service contacted. That last point is the reason it exists in this shape — the domains people most want to decode are the ones they least want to send anywhere.

What it does not do: encode in the other direction, handle full URLs with paths, or predict browser display behaviour. For registering an internationalised domain you want the encoder; for assessing whether a link is a homograph attack, punycod.es shows you more. The algorithm itself is defined in RFC 3492 if you want to know how those xn-- strings are actually constructed.

Which one to pick

• Judging whether a link is a spoof — punycod.es, for the browser display prediction.
• A full URL with a path to convert — Punycoder.
• Encoding a domain in a non-Latin script — Prompt2Tool, or our encoder below.
• Decoding a suspicious domain without sending it anywhere — the tool below.

How to do it with Punycode to Unicode

1. Open Punycode to Unicode and paste the xn-- domain.
2. Read the decoded label and compare it character by character with the brand it resembles.
3. Treat visual similarity as the warning sign, not the reassurance — that is the whole trick.
4. Check the registrar record if the name still looks legitimate.

The walkthrough is in how to decode a punycode domain name. Other developer tools are in the tools directory.

You might also need

For the opposite direction — a Unicode domain you need in ASCII form — the Unicode to Punycode converter is the matching tool.

If the decoded name still looks plausible, Domain WHOIS shows registration age, which is usually the fastest tell: a two-week-old registration of a well-known brand name is not a coincidence.

Frequently asked questions

Is there a free punycode converter that doesn’t send my domain anywhere?

Yes. punycod.es and Prompt2Tool both state conversion happens in your browser, and ours contacts no external service at all. Punycoder does not say either way.

What does the xn— prefix mean?

It is the ACE prefix — “ASCII Compatible Encoding” — marking a label as punycode-encoded rather than a literal domain. Everything after it is the encoded form of the real Unicode label.

Why do browsers sometimes show xn— instead of the real name?

Because they detect a possible spoofing risk — commonly a label mixing scripts, such as Cyrillic characters among Latin ones. Each browser applies its own policy, which is why the same domain can display differently in Chrome and Firefox.

Final thought

Decode first, judge second. A domain that renders as a familiar brand tells you nothing about who owns it, and the entire point of the technique is that your eyes agree with the attacker.

Try the free Punycode to Unicode converter