How to Spot a Punycode Phishing Domain (xn-- Explained)

To spot a Punycode phishing domain, copy the link, keep only the domain name, and convert it to Punycode. If a name you expect to be plain English, like apple.com or paypal.com, comes back starting with xn--, it contains letters from another alphabet and it is not the real site. Our free Punycode converter does this in one click, with no account needed, from any browser.

Every conversion below was run on November 2, 2026, either live in the converter or with the same PHP function (idn_to_ascii, ICU 71.1) on the server behind it. Browser behavior was checked in Chrome 156 and against Chromium's and Mozilla's published IDN display rules.

What xn-- means in a domain

Domain names can use letters from almost any language: münchen.de, españa.com, пример.рф. DNS itself only handles ASCII letters, digits and hyphens, so each non-ASCII label is stored in an encoded form called Punycode, marked with the prefix xn--. münchen.de is really xn--mnchen-3ya.de.

That's also the weak spot. Cyrillic has letters that look exactly like Latin ones: а (U+0430), е, о, р, с, у. A domain spelled with them looks like a brand on screen but is a completely different name in DNS that anyone can register. This is called an IDN homograph attack. The encoding can't lie, even when the letters on screen do, so converting to Punycode is the reliable test.

Check a link now: paste the domain into the free Punycode converter and pick Convert to Punycode/ASCII.

How to check a domain in 30 seconds

1. Copy the link, don't retype it. On a computer, right-click it and choose Copy link address. On a phone, long-press the link and choose Copy. Retyping it fixes the fake letters without you noticing.
2. Keep only the domain. Delete https:// and, if there is an @ before the first slash, everything up to and including it. A path after the domain (/login) can stay.
3. Convert it. Paste it into the Punycode converter, choose Convert to Punycode/ASCII and submit.
4. Read the result. If it comes back unchanged, every character is plain ASCII. If any label of a supposedly English brand now starts with xn--, close the page.

Worked examples: what the converter shows

Each row starts with what you'd see in an email or a chat message. The lookalikes are built for this test; don't visit them.

Look at xn--l-7sba6dbr.com: the readable part before the last hyphen keeps only the ASCII letters of the label. When most of a brand name vanishes from that part, most of its letters were swapped.

Always convert in this direction, not the other one

If someone sends you an xn-- address, decoding it doesn't help much. We ran xn--80ak6aa92e.com through Convert to IDN/Text and got аррӏе.com, which looks exactly like apple.com in most fonts. Decoding shows you what the attacker wants you to see. Encoding what you see shows you what it really is.

Why your browser doesn't always catch it

Browsers do have defenses, but only in the address bar:

• Chrome, Edge and Brave (Chromium) check each label of the domain. Per Chromium's published IDN policy, a label that mixes Latin, Cyrillic or Greek is shown as xn--, and so is an all-Cyrillic label that looks like Latin, unless the domain ends in a TLD where Cyrillic is expected, such as .ru, .ua, .bg or .kz. Chrome has caught whole-script fakes like аррӏе.com since version 58.
• Firefox blocks mixed scripts, but Mozilla's published IDN display algorithm allows whole-script lookalikes by design. To always see the xn-- form, open about:config and set network.IDN_show_punycode to true.
• Everywhere else (email bodies, SMS, chat apps, PDFs, social bios), the link is just text drawn in a font. Nothing checks it. That's where these domains are actually sent to you, and it's where the converter is useful.

Copying the link into Notepad doesn't help either: copy and paste keeps the Unicode letters as Unicode. And the padlock isn't proof. A lookalike domain can get a valid certificate like any other domain (Zheng's 2017 demo ran on HTTPS). The certificate is simply issued for the xn-- name. See how to check an SSL certificate for what a certificate does and doesn't prove.

Pitfalls that give you a wrong answer

Pasting the whole URL

The converter treats its input as a domain. Live, https://аpple.com/login came back as xn--https://pple-49j.com/login, which is meaningless. In Convert to IDN/Text mode, https://xn--80ak6aa92e.com/ came back unchanged, so it looked clean. Remove the https:// first. A path is fine: аpple.com/login gives xn--pple-43d.com/login.

Missing the @ trick

In https://accounts.google.com@аpple.com/, everything before the @ is a username. The site you'd actually reach is аpple.com. If you paste that whole string, the result is mangled (accounts.google.xn--com@pple-46g.com), so check only the part after the @.

Reading the wrong end of the domain

The real owner is the last part of the domain. аpple.com.evil.example converts to xn--pple-43d.com.evil.example, but even with plain ASCII letters, apple.com.evil.example belongs to whoever owns evil.example. Read the domain from right to left.

Several domains at once

Convert one domain at a time. Two domains pasted on separate lines come out garbled (the first line ended in .xn--com), because the line break is treated as part of a label.

An empty result

Invalid Punycode, such as xn--zz.com, gives an empty result box with no error message (live run). Empty doesn't mean safe. It means the label isn't valid, which is itself suspicious in a link.

German ß and a few other letters

Our converter uses older transitional mapping: faß.de became fass.de live. Chrome goes to xn--fa-hia.de, a different domain. The same applies to Greek final ς and the invisible joiners ZWJ/ZWNJ. This rarely matters for phishing checks, but don't copy our result into DNS records for a domain containing ß.

ASCII lookalikes

rn passing for m, 1 for l, 0 for o, or extra words like paypal-secure-login.com are all plain ASCII, so they come back unchanged. For those, run a Whois lookup (a brand's real domain is usually years old; a phishing domain is often weeks old) and follow our checklist on how to check if a website is legit.

When xn-- is perfectly normal

xn-- on its own isn't a warning sign. españa.com is xn--espaa-rta.com, the Russian test domain пример.рф is xn--e1afmkfd.xn--p1ai, and the emoji domain 💩.la is xn--ls8h.la. The red flag is narrower: an xn-- label in a name that should be spelled with only English letters.

If you find a fake

• Don't type anything into the page. Open the real site from a bookmark or by typing the address yourself.
• Pay attention to your password manager. It fills by exact domain, so if it doesn't offer your saved login, the domain doesn't match.
• Report the link to Google Safe Browsing (safebrowsing.google.com, Report phishing) and to the brand being impersonated.
• If the link came as a QR code, decode it first with the QR code reader, then check the domain. Our guide on checking if a QR code is safe covers the rest.

Got a suspicious link right now? Run its domain through the Punycode converter. It's free and needs no account; visitors get 5 checks a day, and a free account (no spam) removes that limit. For short links, the URL redirect checker shows where they lead without opening them in your browser, and the DNS lookup shows where a domain points.

Frequently asked questions

What does xn-- mean in a URL?

It marks a Punycode label: the ASCII form of a domain label that contains non-ASCII letters. The part after xn-- encodes those letters. Convert it to see the original characters, and encode the name you see to check whether it matches.

Is every xn-- domain a scam?

No. Domains in German, Spanish, Russian, Hindi, Chinese and many other languages legitimately use xn--. It's a warning sign only when it appears in a domain that should be spelled with only English letters, such as a bank or a big brand.

Why does my browser show some domains as xn--?

Chrome, Edge, Firefox and Safari show the xn-- form when a domain looks risky, for example when it mixes Latin and Cyrillic letters. Chromium browsers also catch all-Cyrillic lookalikes on non-Cyrillic TLDs. Firefox shows them in Unicode unless you set network.IDN_show_punycode to true.

Does the padlock prove the site is real?

No. A lookalike domain can get a valid HTTPS certificate in minutes. The padlock means the connection is encrypted to that exact domain, and that domain may be the fake one.

Why didn't pasting the link into a text editor reveal xn--?

Copy and paste keeps the Unicode characters exactly as they are, so a Cyrillic а still looks like a Latin a. Only an actual conversion, like Convert to Punycode/ASCII in our converter, shows the encoded name.

Is the Punycode converter free?

Yes. It's free and needs no account; it sends only the text you paste to our server for conversion. Visitors get 5 conversions a day, and a free account (no spam) removes that limit.