Punycode Decoder (ASCII to IDN) Convert Punycode (xn--) domains back to readable Unicode text.
Punycode Decode
Convert Punycode (xn--) domains back to readable Unicode text.
Paste Punycode
Paste the Punycode-encoded domain (xn--...).
View Unicode Domain
The readable Unicode domain appears instantly.
Copy Decoded Domain
Click Copy to copy the decoded domain.
What Is Punycode Decode?
Punycode decoding converts ASCII-compatible encoded domain labels back to their original Unicode characters, allowing developers to work with internationalized domain names in their native form. Domain administrators and security researchers use it to inspect and verify the authenticity of domain names, solving a specific problem where homograph attacks can be hidden behind punycode-encoded labels. For instance, an attacker might register a domain name that appears similar to a legitimate one, such as "xn--mncen-3ya.de" instead of "münchen.de", making it difficult to detect without proper decoding.
The tool implements the Punycode algorithm from RFC 3492, processing the xn-- prefix and separating the basic ASCII portion from the delta-encoded non-ASCII code points. It uses a custom adapt function to calculate bias values for efficient decoding, as seen in the `adapt` function with variables like `damp`, `skew`, and `initialBias`. This approach enables accurate conversion of punycode to unicode characters.
It supports decoding of entire domain names by splitting them into labels and applying the punycode decode process to each label that starts with "xn--", as demonstrated in the `decodeDomain` function. By doing so, it effectively acts as an idn decoder, helping users to identify potential threats or errors in their domain configurations. As a result, developers can use this tool for tasks like inspecting internationalized domain names and detecting homograph attacks by decoding punycode strings back to their original unicode characters.
Why Use Punycode Decode?
-
Reveal true Unicode characters behind xn-- domains
-
Detect homograph attacks using visually similar characters
-
100% client-side — data never leaves your browser
-
Free online tool with instant results
Common Use Cases
Security Analysis
Detect homograph attacks by decoding suspicious xn-- domains.
Domain Verification
Verify Unicode form of registered international domains.
DNS Debugging
Decode Punycode domains in DNS records and logs.
Browser Testing
Verify how international domains display in browsers.
Technical Guide
The Punycode decoding process begins by checking if the input string starts with 'xn--', and if so, it strips this prefix from the encoded domain label. It then separates the basic ASCII portion from the delta-encoded non-ASCII code points using JavaScript's `substring` method and `lastIndexOf` function to find the last delimiter '-'. The tool uses a custom `decodeDigit` function to convert each character in the extended portion into its corresponding numerical value based on its position in the alphabet, with 'a' through 'z' mapped to 0 through 25, 'A' through 'Z' mapped to 26 through 51, and digits '0' through '9' mapped to 52 through 61.
The algorithm utilizes a while loop to iterate over each character in the encoded string, using `charCodeAt` method from JavaScript to get the Unicode value of each character. It employs an adaptation function `adapt` that takes into account variables such as `damp`, `skew`, and `initialBias` to calculate bias values for efficient decoding. The decoded code points are stored in a numerical array `output`, which is then converted back into a string using the `String.fromCodePoint` method from JavaScript, resulting in the original Unicode characters of the domain label.
In terms of data structures, the tool relies on arrays and strings to store the input and output values. For example, it uses an array `output` to hold the decoded code points before converting them back into a string. Additionally, it employs React's `useCallback` hook with TypeScript type annotations for function components to handle user input and process it using the Punycode decoding algorithm implemented in the `punycodeDecode` function. This approach enables accurate conversion of punycode strings back to their original Unicode characters.
The tool also supports decoding entire domain names by splitting them into labels using JavaScript's `split` method with a dot '.' as separator, and then applying the Punycode decode process to each label that starts with 'xn--' in the `decodeDomain` function. It uses React components such as `TextToolLayout` from a custom library to handle user interface interactions, including displaying input fields for encoded domain names and outputting decoded Unicode characters. By combining these technologies, it provides an effective way to decode punycode strings back into their original form, helping users identify potential threats or errors in their domain configurations.
Tips & Best Practices
-
1The xn-- prefix is automatically detected and stripped
-
2Use to inspect suspicious domains for homograph attacks
-
3Each label between dots is decoded independently
-
4Compare decoded domains carefully for visually similar characters
Related Tools
URL Decode (Full)
Decode percent-encoded URL strings back to readable text.
🔐 Encoding & Crypto
Punycode Encode
Convert internationalized domain names to Punycode (xn--) format.
🔐 Encoding & Crypto
Unicode Unescape
Convert Unicode escape sequences (\uXXXX) back to readable text.
🔐 Encoding & Crypto
UTF-8 Encode/Decode
View UTF-8 byte representations of text and decode byte sequences.
🔐 Encoding & CryptoFrequently Asked Questions
Q Is this tool free?
Q Is my data secure?
Q What is a homograph attack?
Q What browsers are supported?
Q Does it handle full domain names?
About This Tool
Punycode Decode is a free online tool by FreeToolkit.ai. All processing happens directly in your browser — your data never leaves your device. No registration or installation required.