What is Punycode?

DNS labels are, in practice, restricted to ASCII letters, digits and hyphens. Punycode, defined in RFC 3492, is the transformation that lets a Unicode label travel through that system: it encodes the non-ASCII characters into a compact ASCII sequence, and the result is marked with the reserved prefix xn-- so software knows to decode it for display.

münchen.example      ->  xn--mnchen-3ya.example
apple.com (Cyrillic а) ->  xn--pple-43d.com

The encoded form is what appears in DNS queries, zone files, TLS certificates and Certificate Transparency logs. The Unicode form is what a browser shows the user — sometimes.

Where it matters for security

Punycode is the mechanism behind IDN homograph attacks. Because many Unicode characters are visually identical to Latin ones, an internationalised domain name can render as an exact copy of a legitimate domain while resolving somewhere entirely different. The homoglyph attack entry covers the deception itself.

Browsers mitigate this by refusing to display the Unicode form in certain conditions — most commonly when a label mixes scripts, or when the script is not one the user’s configured languages would expect — and showing the raw xn-- form instead, which is conspicuous enough to warn a careful user. The heuristics differ between browsers and are considerably weaker in email clients, chat applications and terminal tools, where a rendered link may carry no such hint.

Working with Punycode in practice

Treat the ASCII form as canonical when you are investigating. A domain that renders innocuously may have an xn-- representation that makes the substitution obvious, so convert before comparing names, and search logs and certificate feeds for both forms. When monitoring for lookalikes of your own brands, generate candidate homoglyph variants, encode them, and watch for registrations and certificate issuance against the encoded labels. SurfaceLoop’s lookalike-domain monitoring discloses the Punycode form of each candidate alongside the rendered name, so a visually identical suggestion is distinguishable from an ordinary typo.

Related concepts

See internationalised domain name, typosquatting, DNS record types, and BEC for the fraud that lookalike domains most often support.