What Is Punycode?
Author: Domeny.ForSale editorial team Published
In brief: Punycode is a way of representing Unicode characters, such as the Polish letters “ł” or “ó”, using basic ASCII characters. In domain names, it represents an address containing local letters in a technical form recognisable by the xn-- prefix. For example, bücher.de takes the form xn--bcher-kva.de — these are two representations of the same domain, not two separate addresses to register.
Why do domains need Punycode?
Unicode is a standard covering characters from many languages and alphabets. ASCII is a much smaller character set: it includes basic Latin letters, digits and the hyphen, among other characters, but does not include “ą”, “ę” or “ż”. The traditional representation of hostnames used on the internet relies on this limited set.
To enable the use of names containing local characters, the IDNA mechanism was developed — a set of rules for handling internationalised domain names in applications. A domain containing such characters is called an IDN, or internationalised domain name. Punycode is part of this mechanism: it handles the conversion of characters into an ASCII representation.
Punycode is not encryption and does not secure an address. It is a reversible encoding, so the original characters can be recovered from a valid representation without a password or key. Nor does the xn-- prefix alone indicate that a website is unsafe.
What does an encoded domain look like?
Conversion applies to the individual parts of a name separated by dots, known as labels. For the address bücher.de, the bücher part is converted, while the de extension remains unchanged. If more than one label uses non-ASCII characters, each may require separate encoding.
In this example:
bücheris the user-readable name;bcher-kvais the result of Punycode encoding;xn--bcher-kvais the label with the prefix used by IDNA;xn--bcher-kva.deis the full domain in ASCII form.
Punycode retains the basic characters present in the name and represents the others through an encoded sequence. However, you should not manually append suffixes or try to guess the result — use tools that support IDNA for conversion.
Encoding does not remove diacritics. The domain żaba.pl does not become zaba.pl; these are different names that may have different registrants. The version with Polish characters and its correct xn--… form, however, represent the same domain.
When do you need to use the xn– form?
Users usually enter the name with local letters, and the browser performs the necessary conversion. When managing a domain, however, you may encounter forms that require the ASCII version, for example in a DNS control panel, hosting panel, monitoring tool or server configuration.
There is no single rule for all control panels. Some accept a Unicode name and convert it themselves; others expect the xn-- form. Check the documentation for the specific service to find out which format is required.
A safe configuration procedure is as follows:
- Copy the exact domain name from the registrar’s control panel — the registrar is the company handling its registration.
- Check its ASCII form in the panel or in a tool that supports IDNA.
- Enter the format required by the service, without changing any dots or hyphens.
- After configuration, test the website, HTTPS and — if you use it — email.
The mere fact that text can be encoded does not mean it can be registered as a domain. The registry managing a given extension determines which characters and combinations are permitted. Label length limits also apply, so the length after conversion matters, not just the number of visible letters. Confirm the name’s availability and registration rules with the registrar or the operator of the extension.
Why does the browser sometimes display code instead of letters?
Browsers apply their own rules for displaying internationalised domains. They may show the name with local characters or retain its technical xn-- form. The decision depends, among other things, on the scripts used and mechanisms designed to prevent impersonation of other addresses.
The problem lies in characters that look similar despite having different Unicode codes. For example, the Latin “a” and the Cyrillic “а” can be difficult to distinguish. Using this resemblance to deceive people is called a homograph attack.
Displaying Punycode can make it harder for a fraudster to hide the difference, but it does not replace checking the address. When logging in to your bank or email account, use a saved bookmark or manually enter a known address. HTTPS confirms an encrypted connection to a given domain, not that the domain belongs to the company suggested by the website’s appearance.
Should you choose a domain with Polish characters?
A domain that matches the spelling of a brand name may be easy for Polish audiences to read. However, it can be less convenient for people without a Polish keyboard and in systems with weaker support for internationalised names. When choosing, consider not only how the address looks, but also how you will share it and which tools you use.
If you register both a version with Polish characters and a version without them, choose one as the primary address and redirect the other to it. Redirecting the website does not automatically configure email. In addition, support for an internationalised domain in an email address is a separate issue from support for Unicode characters before the @ symbol.
Before buying a domain, check with your hosting and email provider whether it supports your chosen name and which format it requires. This will help you assess its practical usefulness before printing business cards and publishing the address.
See also: What Is ASCII?
Read also
