Punycode / IDN converter

What it does

• Converts each name both ways: Unicode labels are encoded to punycode (bücher.de to xn--bcher-kva.de) and xn-- labels are decoded, with a per-label breakdown.
• Takes one name per line, and pulls the host out of URLs and email addresses.
• Maps input the way browsers do (UTS 46): lowercase, full-width letters and the ideographic dot 。 to ASCII, invisible soft hyphens and zero-width spaces dropped.
• Checks IDNA 2008 rules: labels up to 63 characters and names up to 253 in ASCII form, no leading or trailing hyphen, no -- in positions 3 and 4 unless it is an xn-- label, no spaces, symbols or emoji, and xn-- labels that decode and re-encode to the same thing.
• Flags lookalikes: labels that mix scripts (Latin with Cyrillic or Greek), labels written entirely in letters that pass for Latin, known confusable characters, and invisible or bidi control characters. It shows the name a lookalike imitates and a table of every character with its code point and script.

Punycode and homograph attacks

DNS only carries ASCII letters, digits and hyphens, so a name like münchen.de is stored as xn--mnchen-3ya.de. Punycode (RFC 3492) is the encoding, and IDNA is the set of rules for which characters a label may contain. Certificates, DNS records and email headers use the xn-- form; browsers show the Unicode form when they consider it safe.

Many letters in other alphabets look identical to Latin ones: Cyrillic а, е, о, р, с and Greek ο are the usual suspects. аррӏе.com written in Cyrillic is a different domain from apple.com but can look the same in an address bar or an email. Browsers counter this by showing punycode for suspicious names, which is why an xn-- name in a link is worth a second look.

Questions

Why does my domain show up as xn-- in the browser?

The browser decided the Unicode form could be confused with another name: usually because a label mixes scripts, uses letters that look Latin, or the script does not match the top-level domain. Showing the punycode form makes the difference visible.

Which form goes in DNS records and certificates?

The ASCII xn-- form. Zone files, CNAME targets, SPF and DMARC records, and certificate SANs all hold the punycode form. Most registrars accept either and convert for you.

Are emoji domains valid?

Not under IDNA 2008, which disallows symbols and emoji. A few registries, such as .ws, still sell them and some browsers resolve them under the older IDNA 2003 rules, but many apps, email systems and certificate authorities reject them.

Is a name flagged as a lookalike always malicious?

No. A word in Russian or Greek can happen to look like Latin letters. The check tells you a name could be mistaken for another; whether that matters depends on what it imitates and where you saw it.