Punycode

What Is Punycode?

Punycode is an ASCII-compatible encoding algorithm for Unicode strings, defined in RFC 3492. It converts a Unicode string — potentially containing characters from any script — into a string using only ASCII letters, digits, and hyphens. Punycode is the mechanism that makes Internationalized Domain Names (IDNs) work within the ASCII-only DNS infrastructure.

A Punycode-encoded IDN label is prefixed with xn-- to mark it as an ACE (ASCII Compatible Encoding) label. The full domain münchen.de becomes xn--mnchen-3ya.de in Punycode.

The Algorithm

Punycode represents a Unicode string in two parts, separated by a hyphen:

1. Basic code points (ASCII characters): copied verbatim before the final hyphen.
2. Non-basic code points: encoded as delta values (variable-length integers) appended after the hyphen.

münchen → m-u-n-c-h-e-n (basic) + ü (non-basic: ü = U+00FC)
xn--mnchen-3ya
       ^      ^
       |      encoding of position and value of ü
       basic chars minus ü

The algorithm uses a generalized variable-length integer (generalized variable-length quantity, or "base-36 with bias") to encode the insertion positions and code point values compactly.

Examples

# Python standard library
"münchen".encode("punycode")         # b"mnchen-3ya"
"例え.jp".split(".")[0].encode("punycode")  # b"r8jz45g"

# With xn-- prefix (full IDNA encoding)
"münchen.de".encode("idna")          # b"xn--mnchen-3ya.de"
"例え.jp".encode("idna")             # b"xn--r8jz45g.jp"

# Decoding
b"mnchen-3ya".decode("punycode")     # "münchen"
b"xn--mnchen-3ya.de".decode("idna")  # "münchen.de"

Common Punycode Examples

Punycode in Browsers

Modern browsers display the Unicode form of IDN labels when the characters all come from a single script and the label passes homograph safety checks. Mixed-script domains or suspicious lookalike characters trigger display of the Punycode form as a security warning:

User types:    https://münchen.de/
Browser shows: https://münchen.de/     (safe: all Latin)
DNS query:     xn--mnchen-3ya.de

User types:    https://pаypal.com/     (Cyrillic а)
Browser shows: https://xn--pypal-4ve.com/  (suspicious: mixed script)

Punycode for Non-DNS Uses

Although designed for DNS, Punycode can encode any Unicode string. It is sometimes used in email systems (IDNA for the domain part) and in IRI (Internationalized Resource Identifier) processing. However, other encodings like percent-encoding are preferred for URL paths and query strings.

Limitations

• Not encryption or compression: Punycode is purely a reversible encoding for ASCII transport.
• Label length: Each DNS label encoded in Punycode must not exceed 63 ASCII characters.
• Readability: xn--fiq228c.com is meaningless to humans — the whole point of IDN display in browsers is to hide this from users.

Quick Facts