Punycode & IDN Converter
Convert a domain between its Unicode and ASCII (xn--) forms, and spot homograph attacks - letters from another script that imitate Latin ones, like a Cyrillic "a" in a fake "apple.com".
FAQ
What is Punycode?
The ASCII encoding (starting with xn--) that DNS uses to represent internationalized domain names with non-ASCII characters.
What is a homograph attack?
An attacker registers a look-alike domain using characters from another script - a Cyrillic a instead of a Latin a - so it looks identical but goes elsewhere. This tool flags labels that mix scripts.
Is every internationalized domain dangerous?
No. Many legitimate domains use non-ASCII characters for their language. The red flag is mixing scripts inside one label.
How do I protect users?
Modern browsers show Punycode for suspicious mixed-script domains. Compare the Unicode and ASCII forms above, and be wary of any label marked as mixed scripts.
Unicode, Punycode and homographs
Domain names on the wire are ASCII. Non-ASCII names are encoded as Punycode (xn--...). A homograph attack abuses characters that look like Latin letters but belong to another script, so the human sees "apple.com" while DNS resolves an entirely different name.
Once you have the ASCII form, run it through the DNS lookup or a full domain report to see where it actually points.