An encoding (RFC 3492) that represents Unicode domain labels using only the letters, digits and hyphens DNS allows. An internationalized label is encoded and prefixed with xn--, so münchen.de becomes xn--mnchen-3ya.de. Browsers translate between the two forms automatically.

What is an IDN homograph attack?

A spoofed domain that swaps letters for visually identical characters from another alphabet, e.g. Cyrillic a in paypal.com. The Unicode form looks legitimate while the real registered name is a different xn-- string. Decoding a suspicious link here shows what is actually registered, and mixed-script labels are flagged.

Why does my browser show xn-- instead of the Unicode name?

Browsers deliberately fall back to the raw Punycode form when a name looks spoofy, typically when scripts are mixed within a label or the characters are not expected for your language settings. Seeing xn-- in the address bar is a signal to check the domain carefully.

Punycode Converter

Domain name (Unicode or xn-- form)

Examples:

Why domains have two spellings

DNS itself only transports the letters a-z, digits and hyphens. Internationalized domain names square that circle with Punycode (RFC 3492): the Unicode label is encoded into that limited alphabet and marked with the xn-- prefix. münchen.de and xn--mnchen-3ya.de are therefore the same domain; your browser shows one and resolves the other. This converter translates both directions and treats each dot-separated label independently, so mixed names convert correctly.

The security angle: phishers register names where a Latin letter is replaced by an identical-looking Cyrillic or Greek one. The famous example xn--80ak6aa92e.com renders as "apple.com" built entirely from Cyrillic letters. Decoding a link before clicking exposes the trick, and this tool additionally flags labels that mix alphabets, the classic homograph signature. If a converted domain looks suspicious, check its registration in the Domain Lookup.