Unicode to Punycode

Unicode to Punycode

Type or paste into Domain names, URLs or email addresses, and the encoded form appears under Punycode as you type. There are two modes:

• Domain names, URLs and email addresses (IDNA, label by label, with the xn-- prefix). This is the form DNS, registrars and browsers use. In a full URL or email address, only the domain is converted, and the path, the query and the part before the @ stay exactly as typed.
• Any text as one raw Punycode string (RFC 3492, no xn-- prefix). The bare encoding, for code, specifications and test data.

You can enter several names at once, one per line. A summary counts the names and labels, and each label gets a row showing what it became and why. Example, Clear and Copy do what you’d expect, and everything runs in your browser.

Example

The Example button loads five names, written the way you’d come across them:

The summary reads 5 names, 10 labels: 6 encoded, 4 kept as they are, and each label gets its own row:

A few things to notice:

• Only the domain changes. In the URL, /straße stays exactly as typed, and in the email address info@ stays too. A path is encoded a different way, as %C3%9F for ß, when a browser sends it. The URL Encoder shows that form.
• Upper case is lowered. Straße.DE gets the note “Upper case became lower case; domain names are case-insensitive.” on both labels. DE is plain ASCII, so it’s only lower-cased and kept. Straße is lower-cased and then encoded, and its ß stays a ß, as explained below.
• Both Russian labels are encoded, because even the ending .рф is Cyrillic.

Where you need the xn-- form

Browsers convert international names on their own, so visitors never see Punycode. But much of the internet’s plumbing only accepts plain ASCII, and that’s where you need the encoded form yourself:

• DNS records and zone files. Many DNS panels want the xn-- form for international names and subdomains.
• Web server configuration. A server block in nginx or Apache matches the name the browser sends, which is the xn-- form.
• SSL certificates. International names appear in certificates in Punycode, so request them that way.
• Email systems and older software, which may only handle ASCII domain names.
• Registrars, some of which show or expect the encoded form.

When a tool or panel rejects your name, try it in the xn-- form.

What happens before encoding

A name isn’t encoded character by character as typed. It’s first normalised by the same rules your browser applies (UTS #46, in its current non-transitional form):

• Upper case becomes lower case. Domain names are case-insensitive, so Straße.DE and straße.de are the same name.
• Full-width letters become plain ones. ｅｘａｍｐｌｅ.com, typed with an East Asian keyboard, becomes example.com.
• ß stays ß. On its own it encodes as xn--zca, and straße as xn--strae-oqa.

That last point matters more than it looks. Older software, following the earlier “transitional” rules, turned ß into “ss”, so straße.de and strasse.de looked like the same name. Under today’s rules they’re two different domains, which can belong to two different owners. If you own one, consider registering the other.

Registries can be stricter than these rules. Each domain ending decides which characters and scripts it accepts, so a name that encodes fine here may still not be available to register.

Label by label, and the limits

Each label, the part between dots, is converted on its own. A label with any character outside ASCII becomes Punycode with the xn-- prefix; a plain ASCII label is only lower-cased.

DNS sets two limits, and the tool flags names that break them:

• A label can be at most 63 characters, counted in its xn-- form. A short Chinese or Cyrillic label can turn out much longer once encoded.
• A whole name can be at most 253 characters.

Raw Punycode

Punycode itself, defined in RFC 3492, is a way to write any Unicode text in plain ASCII letters, digits and hyphens. In raw mode, the whole text is encoded as one string, with no xn-- prefix and no splitting at dots: münchen becomes mnchen-3ya. This is the form libraries and specifications use internally.

Reading Punycode, and spotting fakes

To go the other way, turning xn-- names back into readable ones, use Punycode to Unicode. It also flags domains made of look-alike letters, such as a Cyrillic name pretending to be apple.com. For a closer check of a suspicious link, use the IDN/Punycode Phishing Detector.

FAQ

Is straße.de the same domain as strasse.de?

No. Under the rules browsers use today, ß is kept: straße.de is xn--strae-oqa.de, and strasse.de stays as it is. Older software treated them as one name, which is why both often belong to the same owner.

Can I use emoji in a domain?

Not under the current IDNA rules, and the big generic endings such as .com don’t accept them. A few country endings still register emoji domains under older rules, and browsers can still reach them, but many other systems won’t handle them.

How do I convert names in code?

• JavaScript in a browser: new URL('https://straße.de').hostname gives xn--strae-oqa.de.
• Python: the idna package, as in idna.encode('straße.de'), gives b'xn--strae-oqa.de'. Python’s built-in 'idna' codec still follows the old rules and gives strasse.de.

Does the part before the @ in an email address change?

No. Only the domain is converted, so info@例え.jp becomes [email protected]. International characters before the @ need a mail system that supports them (SMTPUTF8), and they can’t be expressed in Punycode.