Punycode Converter

The punycode itself is implemented here rather than taken from a library, with the parameters RFC 3492 specifies: base 36, tmin 1, tmax 26, skew 38, damp 700, an initial bias of 72, an initial code point of 128, and a hyphen as the delimiter. It is checked in both directions against all nineteen sample strings printed in section 7.1 of the RFC, which cover Arabic, both Chinese scripts, Czech, Hebrew, Devanagari, Japanese, Korean, Russian, Spanish and Vietnamese, and it works on code points rather than UTF-16 code units, so a character outside the Basic Multilingual Plane is one character and not two halves of a surrogate pair.

Before punycode runs, UTS-46 requires lowercasing, normalisation to NFC, and a mapping table that turns thousands of characters into simpler ones (the circled letter U+24D0 into a plain "a", for instance). The lowercasing and the NFC normalisation are done here, which is what makes the two ways of writing an a-with-diaeresis, precomposed or as a plus a combining mark, give the same label. The mapping table is far too large to ship a partial copy of without being quietly wrong somewhere, so the answer this browser’s own IDNA processing gives is computed alongside and shown next to the result. When the two agree, the panel says so; when they differ, it says which one a resolver will actually be asked for.

The length rules run the other way round. A browser applies UTS-46 with the DNS length checks switched off, so it will happily produce a label longer than the 63 bytes DNS allows and a name longer than the 253 bytes a message allows: measured here, an all-diaeresis label is fine up to 57 characters and unresolvable at 58, and the URL parser complains about neither. Both limits are checked and the byte count is shown per label.

Several other things make a name impossible, and each is named rather than swallowed: an empty label, a leading or trailing hyphen, hyphens in the third and fourth position of a label that is not an ACE label, a character no host name may contain, an xn-- label whose contents are not valid punycode, an xn-- label that decodes to pure ASCII, and an xn-- label that does not re-encode to itself. That last one is subtle and real: punycode has exactly one encoding for any given string, so xn--e29bvj decodes to something but encoding that back gives xn--pb45f, which means no such name can have been registered.

Finally, the tool addresses what people usually come here for, which is looking at a suspicious link. Each label is checked for mixing scripts, which is the shape of the classic homograph attack, and every character that is not plain ASCII is listed with its code point, its script, and the Latin letter it imitates if it imitates one. That last part matters more than it sounds: a lookalike label is by definition identical on screen, so a warning that reads "apple looks like apple" tells you nothing, whereas "position 0 is U+0430 (Cyrillic) imitating a" tells you exactly where to look. The lookalike table covers the Cyrillic, Greek and Armenian characters that turn up in real registered domains rather than the whole Unicode confusables file, and the page says so.