Skip to main content

Punycode Decoder (ASCII to IDN) Convert Punycode (xn--) domains back to readable Unicode text.

Punycode Decode illustration
🔐

Punycode Decode

Convert Punycode (xn--) domains back to readable Unicode text.

1

Paste Punycode

Paste the Punycode-encoded domain (xn--...).

2

View Unicode Domain

The readable Unicode domain appears instantly.

3

Copy Decoded Domain

Click Copy to copy the decoded domain.

Loading tool...

What Is Punycode Decode?

Punycode decoding converts ASCII-compatible encoded domain labels back to their original Unicode characters, allowing developers to work with internationalized domain names in their native form. Domain administrators and security researchers use it to inspect and verify the authenticity of domain names, solving a specific problem where homograph attacks can be hidden behind punycode-encoded labels. For instance, an attacker might register a domain name that appears similar to a legitimate one, such as "xn--mncen-3ya.de" instead of "münchen.de", making it difficult to detect without proper decoding.

The tool implements the Punycode algorithm from RFC 3492, processing the xn-- prefix and separating the basic ASCII portion from the delta-encoded non-ASCII code points. It uses a custom adapt function to calculate bias values for efficient decoding, as seen in the `adapt` function with variables like `damp`, `skew`, and `initialBias`. This approach enables accurate conversion of punycode to unicode characters.

It supports decoding of entire domain names by splitting them into labels and applying the punycode decode process to each label that starts with "xn--", as demonstrated in the `decodeDomain` function. By doing so, it effectively acts as an idn decoder, helping users to identify potential threats or errors in their domain configurations. As a result, developers can use this tool for tasks like inspecting internationalized domain names and detecting homograph attacks by decoding punycode strings back to their original unicode characters.

Why Use Punycode Decode?

  • Reveal true Unicode characters behind xn-- domains
  • Detect homograph attacks using visually similar characters
  • 100% client-side — data never leaves your browser
  • Free online tool with instant results

Common Use Cases

Security Analysis

Detect homograph attacks by decoding suspicious xn-- domains.

Domain Verification

Verify Unicode form of registered international domains.

DNS Debugging

Decode Punycode domains in DNS records and logs.

Browser Testing

Verify how international domains display in browsers.

Technical Guide

The Punycode decoding process begins by checking if the input string starts with 'xn--', and if so, it strips this prefix from the encoded domain label. It then separates the basic ASCII portion from the delta-encoded non-ASCII code points using JavaScript's `substring` method and `lastIndexOf` function to find the last delimiter '-'. The tool uses a custom `decodeDigit` function to convert each character in the extended portion into its corresponding numerical value based on its position in the alphabet, with 'a' through 'z' mapped to 0 through 25, 'A' through 'Z' mapped to 26 through 51, and digits '0' through '9' mapped to 52 through 61.

The algorithm utilizes a while loop to iterate over each character in the encoded string, using `charCodeAt` method from JavaScript to get the Unicode value of each character. It employs an adaptation function `adapt` that takes into account variables such as `damp`, `skew`, and `initialBias` to calculate bias values for efficient decoding. The decoded code points are stored in a numerical array `output`, which is then converted back into a string using the `String.fromCodePoint` method from JavaScript, resulting in the original Unicode characters of the domain label.

In terms of data structures, the tool relies on arrays and strings to store the input and output values. For example, it uses an array `output` to hold the decoded code points before converting them back into a string. Additionally, it employs React's `useCallback` hook with TypeScript type annotations for function components to handle user input and process it using the Punycode decoding algorithm implemented in the `punycodeDecode` function. This approach enables accurate conversion of punycode strings back to their original Unicode characters.

The tool also supports decoding entire domain names by splitting them into labels using JavaScript's `split` method with a dot '.' as separator, and then applying the Punycode decode process to each label that starts with 'xn--' in the `decodeDomain` function. It uses React components such as `TextToolLayout` from a custom library to handle user interface interactions, including displaying input fields for encoded domain names and outputting decoded Unicode characters. By combining these technologies, it provides an effective way to decode punycode strings back into their original form, helping users identify potential threats or errors in their domain configurations.

Tips & Best Practices

  • 1
    The xn-- prefix is automatically detected and stripped
  • 2
    Use to inspect suspicious domains for homograph attacks
  • 3
    Each label between dots is decoded independently
  • 4
    Compare decoded domains carefully for visually similar characters

Related Tools

Frequently Asked Questions

Q Is this tool free?
Yes, completely free with no signup required.
Q Is my data secure?
Yes. All processing is 100% client-side.
Q What is a homograph attack?
An attack using visually similar characters from different scripts.
Q What browsers are supported?
All modern browsers including Chrome, Firefox, Safari, and Edge.
Q Does it handle full domain names?
Yes, each label between dots is decoded independently.

About This Tool

Punycode Decode is a free online tool by FreeToolkit.ai. All processing happens directly in your browser — your data never leaves your device. No registration or installation required.