Library
What is Punycode?
Punycode is an encoding that converts Unicode characters into the limited ASCII subset that DNS can handle, making internationalized domain names (IDN) possible. Every Punycode-encoded domain label starts with the xn-- prefix. You'll run into Punycode when registering IDN domains, configuring DNS records, requesting SSL certificates, or setting up email on non-ASCII domains. The same mechanism that enables multilingual domains also enables IDN homograph attacks, where attackers register lookalike domains using visually identical characters from different scripts.
What is an IDN homograph attack?
An IDN homograph attack exploits the visual similarity between characters from different scripts -- like Cyrillic and Latin -- to register domains that look identical to legitimate ones. The attack is made possible by internationalized domain names and the way browsers decode Punycode for display. A password manager is one of the best passive defenses, since it matches on the actual domain string rather than what you see on screen.
What is percent-encoding?
Percent-encoding, also known as URL encoding, converts bytes into %XX hex triplets so that special characters can travel safely inside URLs. Spaces become %20, ampersands become %26, and non-ASCII characters are first encoded as UTF-8 bytes before each byte gets its own triplet. The rules are defined in RFC 3986, while internationalized URLs use the same mechanism through IRIs and Punycode handles the domain name side.
What is IDN?
An Internationalized Domain Name (IDN) is a domain name that uses characters beyond ASCII -- Arabic, Chinese, Cyrillic, or any other Unicode script. Browsers silently convert IDN domains to Punycode (with an xn-- prefix) so the DNS can resolve them. As of 2025, 151 IDN top-level domains exist across 23 scripts, though homograph attacks remain a security concern.