Punycode Explained
How Punycode Converts Unicode Names Into ASCII
Punycode is an encoding that converts a domain label containing non-ASCII characters into a string made only of ASCII letters, digits and hyphens. It lets an internationalized domain name work within a system built for ASCII.
A label is one part of a name between dots. The conversion is applied one label at a time, so only the part with special characters is encoded and the rest of the name stays as it is. The encoded label starts with the prefix xn--. That prefix tells software the label is Punycode and must be decoded back into its original characters before a person sees it.
It is one part of the wider system described in internationalized domain names.
Why Punycode Makes Look-Alike Domain Tricks Possible
Many characters from different writing systems look identical or nearly identical to Latin letters. The Cyrillic letter а, for example, looks like the Latin letter a in most fonts, but the two have different codes. A domain spelled with the Cyrillic letter is a different name from the Latin one, even though a visitor may not notice the difference.
This technique is known as a homograph attack. An attacker registers a look-alike version of a well-known name and uses it in a phishing email or a fake website. Depending on the software, the name may appear in its native form or as an xn-- string, and the native form can make the trick much harder to spot.
Browsers and registries reduce this risk. Many browsers show the encoded form when a name mixes scripts in a suspicious way, and registries restrict which characters may be combined. These defences help but do not remove the risk, so the spelling of an unfamiliar address still deserves a careful look.
Frequently asked questions
Why does my domain show xn-- in the address bar?
Your domain most likely contains a non-ASCII character, and the software you are using is showing its Punycode form. The name still works. Some browsers and tools show the native characters, while others show the encoded version, depending on their IDN display rules and on whether the name mixes scripts.
Is Punycode a form of encryption?
No. Punycode is a reversible encoding that represents characters in a different form. It does not hide, protect or secure anything. Anyone can decode an xn-- label back into its original characters with a standard tool, which is also why the encoding does nothing to prevent look-alike names.
Can I stop look-alike versions of my brand from being registered?
You cannot block every look-alike registration, but you can reduce exposure. Owners often register likely variants of their name and monitor for new registrations. Registering variants in advance is explained in defensive domain registration.