What Is Punycode? Everything Cybersecurity Professionals Need to Know
Written by: Brenda Buckman
Published: 2/17/2026
xn--pple-43d.com can render as apple.com in some browsers, tricking users into entering credentials on phishing sites.Punycode is an encoding syntax used to convert Unicode characters — such as characters from non-Latin scripts like Chinese, Arabic, or Cyrillic — into the limited ASCII character set supported by the Domain Name System (DNS). In cybersecurity, punycode is significant because attackers exploit it in homograph attacks: registering domains that visually mimic legitimate websites by substituting look-alike Unicode characters to deceive users into visiting malicious sites. Understanding punycode is essential for IT professionals, managed service providers (MSPs), and small-to-midsize businesses (SMBs) that want to defend against increasingly sophisticated phishing campaigns.
Punycode is an encoding standard defined in RFC 3492 that represents Unicode characters using only the limited ASCII characters permitted in domain names (letters a–z, digits 0–9, and hyphens). It was created to enable internationalized domain names (IDNs) — domain names written in non-Latin scripts — to function within the existing DNS infrastructure, which only supports ASCII.
For example, the German city name "münchen.com" contains the character "ü," which doesn't exist in ASCII. Punycode encodes this domain as xn--mnchen-3ya.com, allowing DNS servers to process it correctly. When a user visits this domain, their browser may decode the punycode and display the human-readable Unicode version in the address bar.
On one hand, Punycode powers Internationalized Domain Names (IDNs), enhancing internet inclusivity and accessibility worldwide. On the other hand, it gives cybercriminals a way to exploit visual similarities between Unicode and ASCII characters. This has created a pathway to some of the internet’s more cunning attacks.
Punycode converts Unicode domain names to ASCII through a systematic encoding process. Here's how it works step by step:
xn--mnchen-3ya.com.This entire process happens transparently and almost instantly. Users typically never see the punycode version unless their browser is configured to display it — which is exactly what attackers count on.
A punycode phishing attack — formally known as an IDN homograph attack — is a type of cyberattack where an attacker registers a domain name using Unicode characters that are visually identical or nearly identical to the ASCII characters in a legitimate domain. Because the Unicode characters have different underlying code points, the domain is technically different, but it looks the same to the human eye.
For example, the Cyrillic letter "а" (U+0430) is visually indistinguishable from the Latin letter "a" (U+0061) in most fonts. An attacker can register a domain that replaces one or more Latin characters with their Cyrillic look-alikes. The resulting domain appears identical to a trusted brand's website in the browser address bar, but it resolves to a completely different server controlled by the attacker.
The attacker then builds a convincing replica of the legitimate website — complete with login forms, branding, and SSL certificates — and uses phishing emails, ads, or search engine manipulation to drive victims to the fake site. When victims enter their credentials, payment information, or other sensitive data, the attacker captures everything.
This attack is particularly dangerous because it defeats one of the most common security tips: "check the URL before you click." In a punycode homograph attack, the URL looks correct even under scrutiny.
Here’s the issue: Unicode allows the creation of lookalike characters (homographs). When bad actors hop on this train, they can spoof legitimate domains and trick users into visiting malicious websites. Let’s see how it works.
Inclusivity: Businesses in Japan, China, and the Middle East can register local-language domain names.
User experience: Consumers type web addresses using characters familiar to them.
Homograph Attacks: Ever heard of “microsоft.com”? Notice the subtle swap? That’s not an “o” from the Latin script; it’s a character from Cyrillic that looks eerily similar. Hackers register fake domains that visually replicate trusted brands and use them for phishing and malware campaigns.
Evasion of Detection: Punycode-encoded domains often slip through email filters, DNS blocklists, and even experienced cybersecurity eyes.
Coinbase Phishing Attack: A targeted phishing email used the fake domain “cоinbase.com” (with a Cyrillic “о”). It successfully lured victims to enter their credentials on a fraudulent page.
Invoice Fraud: Attackers impersonated an executive’s email, using “ì” (Latin character with an acute accent) in place of a regular “i.”
Homograph attacks rely on lookalike characters to spoof domains. A few examples include:
Cyrillic “а” (U+0430) vs ASCII “a”
Greek “τ” (U+03C4) vs ASCII “t”
This trick convinces users they’re visiting legitimate websites when, in fact, they’re not. A couple of classic Punycode translation examples include:
xn--pple-43d.com → аррӏе.com (fake “apple.com”)
xn--microsft-5xa.com → micrоsоft.com (fake “microsoft.com”)
Encoded strings, like xn--paypal-4ve.com, often appear harmless in email headers or logs, bypassing regex URL filters.
Older Secure Email Gateways (SEGs) and security tools may not fully decode or analyze Punycode, allowing attacks to slip through unnoticed.
Even emojis get Punycode treatment. For example, 🌐.com translates to xn--i-7iq.com, making a phishing campaign even harder to detect, thanks to its novelty.
Punycode attacks are like ghosts in the IT machine—not easily spotted and nearly impossible to stop if you’re unprepared.
Undetectable to Users: Unicode lookalikes can be visually identical to legitimate URLs, particularly in certain fonts or low-res settings.
Exploiting Mobile Devices: Tiny screens, lack of hover previews, and urgent browsing make mobile users particularly vulnerable.
Browser Discrepancies: While Chrome may display raw Punycode, Safari often renders Unicode, creating inconsistency in detection.
Hackers use punycode as a foundational tool in several types of cyberattacks that target human perception rather than technical vulnerabilities. The most common attack methods include:
The most prevalent use of punycode in cyberattacks is phishing. Attackers register a homograph domain, build a pixel-perfect clone of a target website (such as a bank, email provider, or SaaS application), and send phishing emails directing victims to the fake site. Because the domain appears legitimate, victims enter their usernames and passwords without suspicion. The attacker harvests these credentials and uses them to access real accounts, sell them on dark web marketplaces, or launch further attacks.
Attackers use punycode domains to impersonate executives, vendors, or partners in business email compromise schemes. By registering a homograph domain that matches a company's real domain, the attacker can send emails that appear to come from a trusted source — requesting wire transfers, sensitive documents, or changes to payment information.
Homograph domains serve as convincing delivery mechanisms for malware. An attacker creates a fake software download page on a punycode domain that mimics a trusted vendor. Victims searching for legitimate software may land on the fake site and download trojanized installers that deploy ransomware, remote access trojans (RATs), or information stealers.
In targeted campaigns, attackers identify websites frequently visited by employees of a specific organization, register homograph versions of those domains, and redirect or lure targets to the spoofed sites. These watering hole attacks can deliver tailored payloads designed to compromise specific networks.
Punycode domains can be used to impersonate software repositories, API endpoints, or update servers. If a developer or automated system is tricked into connecting to a homograph domain instead of the legitimate service, the attacker can inject malicious code into the software supply chain.
Attackers use Punycode to register domains that look identical to legitimate ones in your browser's address bar, making homograph attacks among the most sophisticated URL-based deception techniques in active use today, so download the Huntress 2026 State of Phishing report to see how look-alike infrastructure is being weaponized and which defenses are actually working.
Detecting punycode attacks requires a combination of technical controls and human awareness. Here are the most effective detection methods:
network.IDN_show_punycode to true in about:config. Chrome and Edge now display punycode by default for domains that mix scripts from different languages.Protecting your organization from punycode attacks requires a layered defense strategy that combines technology, training, and process. Here's how to build comprehensive protection:
Punycode was built to make the internet inclusive, but that inclusivity comes with risks. For cybersecurity professionals, staying ahead of these exploits means staying informed.
At the end of the day, defending against Punycode phishing isn’t just about having tools; it’s about visibility, vigilance, and action. Train your team, harden your systems, and keep one eye on that seemingly harmless “xn--” prefix.
Special thanks to Dave Kleinatland for the graphics in this guide.
Punycode is an encoding system that converts Unicode characters (like those in non-Latin scripts such as Chinese, Arabic, or Cyrillic) into ASCII characters so they can be used within the Domain Name System (DNS). For example, “münchen.com” becomes “xn--mnchen-3ya.com.”
Punycode can be exploited in homograph attacks, where cybercriminals use lookalike characters from Unicode to mimic legitimate domains. For instance, “microsоft.com” (using a Cyrillic “о”) can deceive users into thinking they’re visiting a trusted site, leading to phishing or malware distribution.
Look for domains that have a prefix like “xn--.” This indicates they’ve been encoded with Punycode. Tools and browser settings can help display the raw Punycode instead of the Unicode representation.
Businesses can:
Yes, there are online decoding tools that can convert Punycode back to its Unicode representation. These tools are valuable for verifying suspicious URLs and preventing phishing attacks.
