Skip to content

Punycode to Unicode Converter

Decode Punycode (ACE-encoded) domain names and strings back into their original Unicode characters, such as internationalized domain names (IDNs).

Category: data
Use Case: Internationalized Domains (IDN), Domain Debugging, Security Analysis
Privacy: 100% browser-based

Conversion Options

Disable this only if you're decoding a single raw Punycode string that isn't a domain name.

Recommended Settings

Pro Tips

  • Punycode labels always start with the 'xn--' prefix in real-world domain names (IDNA)
  • Labels that don't start with xn-- are passed through unchanged, so you can safely paste a mixed domain like xn--mnchen-3ya.de
  • Enter multiple domains, one per line, to convert a whole list at once
  • Disable 'Treat as full domain' only when decoding a single Punycode string that isn't part of a hostname
  • This decoder implements the standard Punycode algorithm from RFC 3492, the same one browsers use for internationalized domains

Most Popular

Most users paste full domains (with the xn-- prefix and dots) and keep domain-splitting enabled

When to Use This Tool

Internationalized Domain Names (IDN)

Decode ACE-encoded domain names like xn--mnchen-3ya.de back into their native-script form (münchen.de) to see what a domain actually displays as.

Security & Phishing Analysis

Inspect suspicious domains found in emails or logs that use Punycode to disguise lookalike characters, revealing the real Unicode characters behind an xn-- hostname.

Domain Debugging

Troubleshoot DNS records, certificates, or server configs that store domains in their ASCII-compatible encoding (ACE) form, converting them back to readable Unicode for review.

Web Development & Localization

Verify that internationalized domains used in a multilingual site or app resolve to the intended native-language hostname.

How It Works

1

Split the input into dot-separated labels (unless 'Treat as full domain' is disabled)

2

For each label starting with the xn-- prefix, strip the prefix and decode the remaining ASCII-compatible encoding

3

Separate the encoded string into its basic ASCII code points and its extended (encoded) code points, marked by the last hyphen

4

Decode the extended part using the standard Punycode generalized variable-length integer algorithm (RFC 3492) to recover each non-ASCII code point and its insertion position

5

Rebuild the original Unicode string by inserting each decoded code point at its correct position

100% Private

Files never leave your device. All processing happens locally in your browser.

Lightning Fast

Powered by Pure JavaScript (RFC 3492 Punycode algorithm) for optimal performance on modern browsers.

Secure

No data collection, no tracking, no sign-up required.

Frequently Asked Questions

What is Punycode?

Punycode is an encoding used to represent Unicode text using only the limited ASCII character set allowed in domain names. It's the basis of Internationalized Domain Names (IDNA), letting domains contain non-Latin scripts while remaining compatible with DNS infrastructure that only understands ASCII.

Why do Punycode domains start with xn--?

The xn-- prefix (an ASCII Compatible Encoding, or ACE, prefix) signals to DNS resolvers and browsers that the label that follows is Punycode-encoded and should be decoded and displayed as Unicode text to the user.

Can I decode a whole domain, not just one label?

Yes. With 'Treat as full domain' enabled, the input is split on dots and each label is decoded independently - so a domain like xn--e1aybc.xn--p1ai decodes label by label into its full Unicode hostname.

What happens to labels that aren't Punycode?

Any label that doesn't start with xn-- is passed through unchanged, so you can paste an entire mixed domain (like a Punycode subdomain under a plain .com) and only the encoded parts will be converted.

Why would Punycode be used for phishing?

Some Unicode characters look nearly identical to ASCII letters (a 'homograph'). Attackers register Punycode domains that decode to lookalike Unicode text to impersonate legitimate sites. Decoding a suspicious xn-- domain reveals its real characters, which helps spot this kind of spoofing.