⌘ K
idn · rfc 3492 · xn-- prefix · per-line · live

Convert Punycode and Unicode domains

Encode internationalised domain names to their xn-- ASCII form and back. One domain per line. RFC 3492 — the same algorithm browsers use for DNS lookups. All processing runs locally.

Punycode Converter
Input
29 B
3 lines
Output
62 B
3 lines
Status
ready
live
Ratio
2.14×
out/in
input · unicode domain
output · punycode
xn--m14nchen-rza5441f.de
xn--ba5jlec72vl64e.jp
xn--fa-tia6i.de
Quick Start

How to convert IDN ↔ Punycode

Punycode encodes each label of a domain separately. Labels with non-ASCII characters get an xn-- prefix and a Bootstring-encoded suffix.

  1. 01

    Pick direction

    Encoding goes Unicode → ASCII; decoding reverses it.

    Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.

    modeUTF-8TextEncoderlosslesslive
    mode · raw bytesencode · UTF-8
    münchen → xn--mnchen-3ya
    loaded · UTF-8MIME · ready
  2. 02

    Paste domains

    One per line — TLD-aware: only non-ASCII labels are touched.

    Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.

    inputWeb Cryptosubtledeterministiclive
    lines · optionsok · live
    münchen.de
例え.jp
    options applied · livelive
  3. 03

    Live convert

    Each label encodes independently — .de or .jp pass through.

    Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.

    livememoisedoptionsinstantreactive
    out · encodedxn-- · ready
    xn--mnchen-3ya.de
    encoded · livelossless
  4. 04

    Copy or download

    One click to clipboard. Download as .txt.

    Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.

    exportclipboardblobMIME-correctclient-side
    ok · copiedready · done
    Copied
    shipped · ready to shipsuccess
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsURL EncoderURL DecoderUnicode ConverterHTML Entity LookupASCII ConverterText to Hex
Use Cases

When to convert Punycode

DNS debugging, security audits, registrar tooling.

DNS lookups

Translate IDN domains to the ASCII form resolvers need. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Phishing audits

Spot xn-- domains in phishing reports. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Registrar work

Bulk-convert IDNs for WHOIS or domain transfers. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Browser debugging

See exactly how a browser maps the address bar. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Certificate SANs

TLS certs use ASCII — convert before requesting. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Internationalisation

Configure mail servers for non-ASCII domains. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

i18n
FAQ

Frequently asked questions

RFC 3492's algorithm for representing Unicode strings using only ASCII letters, digits, and hyphens. The DNS system requires ASCII, so non-ASCII domain labels get xn-- prefixes and a Bootstring-encoded suffix.
Domains often come from spreadsheets or registrar lists. Per-line input means one domain in, one domain out — easy to diff.
Yes. Pure-ASCII labels (like .de) pass through; only labels containing non-ASCII get the xn-- treatment. That matches DNS behaviour.
Punycode is just the byte-level algorithm. IDNA2008 adds rules about which characters are valid in a domain. This tool implements the Punycode layer.
No. Conversion runs locally in your browser.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!