Punycode & Homograph URL Checker
Decode any xn-- domain and see which characters are not what they look like, plus why mixed-script detection misses the dangerous case.
Paste anything — a punycode label is decoded to show what it really reads, and a Unicode one is encoded to show what actually gets registered. The per-character table names the script each letter belongs to, which is where a lookalike gives itself away. Nothing is uploaded and no lookup is performed; this is pure string analysis.
The encoder is checked against the RFC's own vectors
RFC 3492 publishes worked examples in section 7.1. All 10 encode and decode correctly here, and the results agree with the browser's own IDN handling — a second implementation nobody on this page wrote.
| Vector | Text | Punycode |
|---|---|---|
| Arabic (Egyptian) | ليهمابتكلموشعربي؟ | egbpdaj6bu4bxfgehfvwxn |
| Chinese (simplified) | 他们为什么不说中文 | ihqwcrb4cv8a8dqg056pqjye |
| Chinese (traditional) | 他們爲什麽不說中文 | ihqwctvzc91f659drss3x8bo0yb |
| Czech | Pročprostěnemluvíčesky | Proprostnemluvesky-uyb24dma41a |
| Hebrew | למההםפשוטלאמדבריםעברית | 4dbcagdahymbxekheh6e0a7fei0b |
| Japanese | 3年B組金八先生 | 3B-ww4c5e180e575a65lsy2b |
One of those ten failed at first, and the failure was in the test rather than the code — the plaintext for one vector had been transcribed wrong. Running the decoder on the RFC's own ciphertext produced the correct string, which is how we found out which side was mistaken. A published test vector is only useful in both directions.
The number of lookalikes multiplies with length
23 of the 26 Latin letters have at least one character in another script that is visually identical in an ordinary sans-serif face. The number of confusable spellings is the product of the options per letter, so it multiplies rather than adds.
| Name | Letters | Lookalike spellings | One of them |
|---|---|---|---|
| paypal | 6 | 2,303 | раураⅼ |
| 6 | 1,727 | ɡооɡⅼе | |
| apple | 5 | 431 | аррⅼе |
| amazon | 6 | 1,151 | амаᴢоո |
| chase | 5 | 431 | сһаѕе |
| meta | 4 | 71 | меτа |
The length dependence is steep because it is multiplicative: the six-letter names here run past 1,151, the five-letter ones sit in the hundreds, and a four-letter one has seventy-one. Every one of those spellings is a distinct string, and therefore a distinct domain somebody can register.
These counts use a curated set of genuine lookalikes rather than the full Unicode confusables table, which runs to thousands of entries. So they are a floor on how many variants exist, not the true total.
The dangerous lookalikes are the unmixed ones
Browsers defend against this by showing the raw punycode when a label mixes scripts. Swap one letter of "paypal" for its Cyrillic twin and that triggers — the label is now part Latin, part Cyrillic. Swap every letter and it does not: the result is uniformly Cyrillic, with no mixing left to detect.
| Label | Scripts | Mixed? |
|---|---|---|
| paypal | Latin | no — it is the real one |
| pаypal | Latin + Cyrillic | yes |
| раураӏ | Cyrillic | no |
That third row is the whole problem. It registers as
xn--80aa0cbo65f, which looks nothing like
the brand — but the address bar may render it back as the Cyrillic spelling, and that is
visually indistinguishable from the real thing at normal size.
So the checker above reports a label written entirely in one non-Latin script as worth a look, rather than passing it because nothing is mixed. Mixed-script detection is a real defence against the easy version and no defence at all against the careful one.
What this does not tell you
This is string analysis and nothing more. It does not resolve the domain, check a reputation list, or know whether a site is hostile — a perfectly ordinary business may have a legitimate internationalised name, and plenty of pure-ASCII domains are fraudulent. What it does is tell you exactly what characters are in front of you and what they encode to, which is the part your eyes cannot do. Judging intent is still yours.
How to use
- Paste a domain or a whole URL.
- A punycode label is decoded to show what it really reads.
- The character table names the script of every letter.
- Anything outside Latin is highlighted.
Frequently asked questions
What is punycode?
The encoding that lets a domain contain non-ASCII characters while the underlying system stays ASCII-only. A label beginning xn-- is punycode, and münchen.de is really xn--mnchen-3ya.de. It is defined by RFC 3492 and it is exact and reversible in both directions.
How do I know this encoder is right?
It reproduces all ten worked examples published in RFC 3492 section 7.1, in both directions, and its output matches the browser’s own IDN handling — a second implementation nobody here wrote. One of those ten failed at first and the mistake was in our transcription of the expected text, not in the code.
How many lookalike domains can a name have?
Far more than people expect, because the count multiplies rather than adds. Twenty-three of the twenty-six Latin letters have at least one character in another script that is visually identical, so a six-letter brand runs past two thousand spellings, a five-letter one is in the hundreds and a four-letter one has seventy-one.
Do browsers not protect against this?
Partly. They show the raw punycode when a label mixes scripts, so swapping one letter of a brand for a Cyrillic twin is caught. Swapping every letter is not: the result is uniformly Cyrillic, with no mixing left to detect, and that is precisely the well-known version of the attack.
So what should I look at instead?
Whether the label is written in a script you did not expect at all, mixed or not. This page reports a single-script non-Latin label as worth a look rather than passing it, and shows the code point and script of every character so you can see which ones are not what they appear to be.
Are all internationalised domains suspicious?
Not at all, and treating them that way would be both wrong and unhelpful. Most exist because a business has a name in its own language. The point is not that non-ASCII is bad, it is that your eyes cannot distinguish some characters and a machine can.
Does this check whether a site is safe?
No. It performs no lookup of any kind — no resolution, no reputation list, no request. It is pure string analysis that tells you exactly what characters are in front of you and what they encode to. Plenty of pure-ASCII domains are fraudulent and plenty of internationalised ones are ordinary businesses.
Does this send anything anywhere?
No. Everything is computed in your browser, and nothing is uploaded.
🔒 This tool runs entirely in your browser. Nothing you enter is uploaded, logged, or stored.