What is Punycode?
Punycode (RFC 3492) is an encoding scheme that converts Unicode strings to ASCII.
It enables Internationalized Domain Names (IDN) — domain names containing accented
or non-Latin characters such as münchen.de
or пример.испытание — to function within
the DNS infrastructure, which only supports ASCII.
Each dot-separated label is encoded independently. Labels containing non-ASCII characters receive
the prefix xn--, followed by the ASCII
characters of the label and then the encoded positions and code points of the non-ASCII characters
using a compact base-36 scheme. Pure-ASCII labels are left untouched.
In münchen the ASCII characters
mnchen are kept as-is, a hyphen delimiter
is appended, and the position and code point of the ü
are encoded as 3ya — giving
xn--mnchen-3ya.
Security: Homograph Attacks
Visually identical characters from different Unicode scripts — for example the Cyrillic
а (U+0430) versus the Latin
a (U+0061) — can produce domain names
that appear identical to trusted sites but resolve to entirely different addresses.
Decoding a suspicious domain to its Punycode form immediately reveals such spoofing.
Example: аpple.com (Cyrillic а)
→ xn--pple-43d.com