Decode a Punycode (xn--) Domain Online

Reveal what a suspicious xn-- link really resolves to before you click. Decoding shows the actual characters, exposing lookalike phishing domains.

xn--

Punycode Encoder/Decoder

LOCAL · Browser-Only

Convert internationalized domain names (IDN) between Unicode and ASCII-compatible Punycode encoding per RFC 3492

Unicode Domain / Text

Punycode Result

·Share recipe

Quick Start

1Paste the xn-- domain into the input field
2The tool decodes it to the readable Unicode name
3Compare the characters against the domain you expected
4Use batch mode to decode several domains at once

What This Tool Does

An xn-- label is a plain ASCII encoding of a name that was written in another script. Decoding turns the label back into the characters it stands for, which is the only way to see what a link is really claiming to be.

The decoded name is then checked for mixed scripts inside a single label. A label combining Latin letters with Cyrillic, Greek, Han, Hangul, Arabic or Hebrew characters is flagged, because that mixture is the standard way a lookalike domain is built.

Three views share the same input. Convert handles one domain and shows a character-by-character code point table. Batch takes a list, one domain per line, and converts each independently so a bad line reports its own error instead of stopping the run. Codepoints inspects arbitrary text rather than a domain.

Limits Worth Knowing

Only mixed scripts within one label are flagged. A name written entirely in one non-Latin script is legitimate and is not marked, so an all-Cyrillic lookalike passes without a warning.
There is no confusable character table. The check is about script mixing, not about which particular characters resemble which.
Encoding lowercases every label, so original capitalization is not preserved through a round trip.
The code point table on the convert view shows the first fifty characters. The codepoints view shows all of them.
Results copy to the clipboard. There is no file upload or download.

Common Questions

What does a mixed-script warning actually mean?

One label contains characters from more than one writing system and at least one of them is not Latin. That is unusual in a real domain and normal in a lookalike, so it is worth stopping to check.

Is an xn-- domain automatically suspicious?

No. It is how every non-English domain name is written at the DNS level. The question is only whether the decoded name is the one you expected.

Can I check a whole list at once?

Yes, on the batch view. One domain per line, each decoded on its own, with any failure reported inline next to the line that caused it.

More Decode Tools

All decoders →

Decode Base64 to Text Online

Decode Base64-encoded strings back to readable text. Free online Base64 decoder with UTF-8 support.

URL Decode Percent-Encoded Text Online

Decode percent-encoded URL strings back to readable text. Free online URL decoder for query strings and URIs.

Decode JWT Tokens Online

Decode and inspect JWT token headers and payloads without verification. Free online JWT decoder with claim analysis.

Decrypt AES-256 Encrypted Text Online

Decrypt AES-256-GCM encrypted Base64 ciphertext back to plaintext. Free online AES decryption tool.

Decode Caesar Cipher Online - Brute Force All Shifts

Decode Caesar cipher text by trying all 26 shift values. Free online Caesar cipher decoder and cracker.

Base64 to Text Decoder - Free Online Tool

Decode a Base64 string back to readable text online for free. Inspect data URIs, JWT segments, and encoded headers, all in your browser.

Looking for FAQs and advanced options? Visit the full Punycode Converter page →