A label mixing two scripts
The homograph pattern: it renders like a name you trust and resolves elsewhere
аpple.com
Punycode and IDN Converter
Convert a domain between its Unicode and punycode forms, check the 63-byte label limit against the encoded length, and detect the mixed scripts that make one name render identically to another.
Paste below, or drop a file anywhere on this panel
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Convert. Nothing leaves this tab.
Formatted
Results
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Examples
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
Already encoded
Decoding shows what a user would have seen in the address bar
xn--mnchen-3ya.de
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Checking the length of the Unicode form
The 63-byte label limit and the 253-byte name limit apply to the punycode form, and punycode often more than doubles non-ASCII text. A name that looks short can be too long.
Instead:Measure the encoded form. This page shows both lengths against their limits.
Flagging every internationalised domain as suspicious
A name entirely in one script is exactly what IDN is for. A check that warns on all of them is noise and gets switched off, taking the real signal with it.
Instead:Flag MIXED scripts within a single label. That is the homograph pattern and it has no legitimate use.
Assuming a working IDN domain means a working IDN mailbox
IDNA covers the domain part. A non-ASCII local part needs SMTPUTF8 at every hop, and a server without it rejects the address rather than encoding it.
Instead:Test the mailbox separately from the domain.
The homograph attack, and a length limit that applies to the wrong form
An internationalised domain is stored as ASCII and displayed as Unicode. Both the security problem and the length problem come out of that gap.
Mixed scripts in one label is the attack
A Cyrillic and a Latin letter can render identically in most fonts, so a name can look exactly like one you trust and resolve somewhere else entirely. Browsers defend by displaying the punycode form instead of the Unicode form when a label mixes scripts, which is why a legitimate site almost never does it. If you did not construct the name yourself, treat a mixed-script label as hostile.
A wholly non-Latin name is not suspicious
This matters, because a check that flags every internationalised domain is useless noise that gets switched off. A name entirely in one script is exactly what IDN exists for. It is the MIXING that has no legitimate purpose, and that is what gets flagged here.
The 63-byte limit applies to the punycode form
DNS limits a label to 63 bytes and a whole name to 253, and both are measured on the encoded form rather than on what you typed. Punycode expands non-ASCII text considerably, often more than doubling it, so a name that looks comfortably short can be too long. There is no way around the limit.
The xn-- prefix marks an encoded label
Seeing it in a log, a certificate or a header means you are looking at the wire form. Decoding it shows what a user would have seen in the address bar, which is the comparison worth making when you are working out whether a request came from where it claims to have.
Email is a separate problem
IDNA covers the domain part only. A non-ASCII local part before the at sign needs SMTPUTF8 support at every hop, and a server without it rejects the address rather than encoding it. So a working internationalised domain does not imply a working internationalised mailbox, and the two have to be tested separately.
What this cannot see
Whether the domain is registered, who owns it, or whether a visually similar name exists. It converts and inspects the string you paste, in your browser, and makes no DNS query. For a real homograph check against a brand you own you need a registry search, which is a different kind of tool.
More encoding tools
Base64 Encoder & Decoder Both directions, UTF-8 done right Unix Timestamp Converter Seconds or milliseconds? It says which JWT Decoder & Inspector Read the claims, and what is wrong with them URL Encoder and Decoder Which of the two functions you actually want HTML Entity Encoder and Decoder Five characters, not four hundred Hex Encoder and Decoder Bytes, with a hex dump Base32 Encoder and Decoder Two alphabets that decode differently String Escape Converter Six targets, one of them injection