Library

Lookalike letters, including Cyrillic and Latin characters, let an IDN homograph attack disguise one domain as another. For internationalized domain names, a browser chooses whether to display Unicode characters or the ASCII form built with Punycode, so a suspicious name can look different between browsers. Check the underlying domain before signing in; a password manager with domain-based matching can help catch a mismatch that is hard to see.

Percent-encoding, often called URL encoding, writes a byte as % followed by two hexadecimal digits — the %XX form defined in RFC 3986. A space becomes %20 and an ampersand used as data can become %26; which characters need escaping depends on the URL component. Internationalized URLs use UTF-8 bytes for non-ASCII text before percent-encoding, while internationalized domain names use IDNA and Punycode for the host labels.

Punycode encodes Unicode text as ASCII; IDNA uses that algorithm for valid Unicode labels in internationalized domain names (IDN). IDNA adds the xn-- prefix to the encoded label, giving you the ASCII form used in domain registration, DNS records, TLS certificates and email configuration. Keep the distinction between encoding and identity in mind: a name built from similar-looking characters in different scripts can still be used in an IDN homograph attack.

An internationalized domain name (IDN) can contain non-ASCII characters from scripts such as Arabic, Chinese and Cyrillic, subject to IDNA and registry rules. IDNA uses Punycode to form ASCII labels with an xn-- prefix for DNS lookups; browsers apply separate rules to how they display those names. ICANN counted 151 IDN top-level domains across 23 scripts in June 2025, but the letters still deserve scrutiny — lookalikes can be used in homograph attacks.