What is punycode?
Punycode is a way of writing any Unicode text using only the characters DNS was built to carry: letters, digits and hyphens. Encoded names are marked with an xn-- prefix so software knows to decode them.
So münchen.de travels across the internet as xn--mnchen-3ya.de. Same domain, two representations. Your browser converts back for display, which is why you rarely see the encoded form unless something goes looking for it.
How do you convert punycode to a domain name?
Paste either form into the box. It detects which direction you need and shows both, along with a breakdown of every part of the name.
Paste xn--mnchen-3ya.de and you get münchen.de. Paste münchen.de and you get the encoded form. A full web address works too, the hostname is extracted and the rest ignored.
Why do domain names have two forms?
DNS was designed in the early 1980s for a network that was almost entirely English, and it only carries a small set of ASCII characters. That was workable then and useless for most of the world.
Rather than change DNS everywhere at once, which was never going to happen, an encoding was defined that packs any Unicode text into the characters DNS already accepted. The result is that internationalised domain names work on infrastructure that has no idea they exist.
What is a punycode phishing attack?
It is the reason this tool has a security use. Cyrillic а and Latin a look identical in almost every typeface, and they are entirely different characters. That means аpple.com with a Cyrillic first letter is a completely different domain from apple.com, available to register, and indistinguishable in a link.
These are called homograph attacks. Mixing writing systems inside one part of a name is the usual shape, so this tool flags that and lists the exact code points so you can see which character is doing the impersonating.
Be careful with the conclusion though. Plenty of legitimate names in multilingual regions mix scripts, and a name written entirely in Cyrillic is completely normal in a Cyrillic-speaking country. Mixed script is a reason to look closely, not a verdict.
What will this not catch?
Lookalikes built from ordinary ASCII. paypaI.com with a capital i, or rn standing in for m, are pure Latin characters and no script check will ever flag them.
So a clean result here is not a clean bill of health. It means the name is not using the specific trick this tool detects. Reading the characters yourself is still worth doing.
Browsers also make their own decisions about when to display a name readably and when to show the raw xn-- version. Those rules differ between Chrome, Firefox and Safari and change over time, so what your address bar shows may not match what is here.
Why is my converted domain name too long?
Each part of a domain has a hard limit of 63 bytes, and encoding inflates things. A handful of non-ASCII characters can easily triple in length, so a name that looks short in its readable form can exceed the limit once encoded.
People hit this unexpectedly when registering, which is why the breakdown above shows the byte count for each part against the ceiling and colours it as you approach.
Does punycode apply to the whole URL?
No, only the domain name. The path and query string of a URL use percent encoding, which is a completely different mechanism that produces things like %20 for a space. If you paste a full address here, the hostname is taken and the rest is ignored.
Related tools
If a link looks wrong, converting it here shows the real characters. From there, the domain age checker will tell you how recently the name was registered, which is often the more telling signal, and the domain registration lookup gives you the whole record.