Punycode email domains, and how to use them safely

Published: 2026-07-23

Some of the domains you can pick on this site are not written in plain a–z letters. They contain accented or non-Latin characters — münchen.de, café.com, пошта.укр. Under the hood the mail system does not see those pretty letters at all: it sees an ASCII-only form that starts with xn--. That form is called Punycode, and this page explains exactly what it is, shows you both forms of any domain side by side, and points out the one place where internationalized domains are genuinely worth being careful.

What is a punycode domain?

The Domain Name System was built in an era when host names were ASCII only: the 26 Latin letters, the digits 0–9, and the hyphen. That rule never went away. Yet most of the world does not write in that alphabet, so in 2003 the standards added Internationalized Domain Names (IDN): you can register пошта.укр or 日本語.jp, but before the name touches DNS it is transparently translated into a plain-ASCII stand-in.

That translation is Punycode (RFC 3492). Each label that contains non-ASCII characters is encoded and prefixed with xn--. The prefix is a flag that says “decode me back into Unicode before showing me to a person.” A label that is already plain ASCII is left untouched — there is no xn-- and nothing to convert.

Notice пошта.укр: both labels are non-Latin, so both get an xn-- form — the name and the top-level domain each convert independently. Punycode always works label by label, split on the dots.

What you see versus what the mail system sees

An email address has two halves: the local part before the @ and the domain after it. Punycode only ever touches the domain. So an address on an internationalized domain has, in effect, two spellings that point at exactly the same mailbox:

These are not two different accounts. They are one address written two ways, the same way 2 and II are one number. Mail servers, DNS lookups and spam filters work on the xn-- form; your address book and the pretty label in a browser use the Unicode form. This generator shows you the human form for readability and the xn-- form for copy-paste, precisely so you are never guessing which one to give out.

Can a punycode domain ever misbehave?

Delivery itself is reliable — the encoding is a solved, standardized problem. Where trouble creeps in is at the edges, in software that was written as if every address were plain ASCII. The realistic failure modes are:

• An old form that rejects the accented letters. Some sign-up boxes validate the local part and domain against a strict a–z0–9 pattern and refuse café.com outright, even though it is a valid address.
• Copy-paste that drops or mangles a character. Non-Latin letters can be lost when text passes through a system with the wrong character encoding, turning the domain into something that no longer resolves.
• A keyboard that cannot type the letter. You may need to give the address to someone whose device has no way to enter ü or ш.

The look-alike trap — where you really must pay attention

This is the one part of internationalized domains that is not just trivia. Different alphabets contain letters that are drawn identically to Latin ones. The Cyrillic а, the Greek ο and the Latin a/o can look pixel-for-pixel the same in most fonts, yet they are different characters with different Punycode. Scammers exploit exactly this: they register a domain that looks like a brand you trust, then rely on your eye not catching the swap. It is called a homograph attack.

Every domain on the left reads like a household name, but none of them is. Paste any of them into the converter above and the xn-- form gives the game away instantly — a genuine apple.com is already plain ASCII and would show no xn-- at all.

How this generator handles it

When you pick an internationalized domain here, three things happen so nothing is ambiguous:

• The address is created on the real domain and receives mail normally — the inbox on this page updates just the same as for an ASCII domain.
• Under the visible address we show a small notice with the xn-- form, so you can hand out the version that every external system accepts. That notice links straight back to this page.
• The Unicode and ASCII spellings are treated as one and the same mailbox, so it never matters which one a sender used.

In other words, you get the readable name for yourself and the bullet-proof xn-- name for anywhere that might be picky — without having to run the conversion in your head.

Frequently asked questions

Do I have to do anything special to receive mail on a punycode domain?

No. Generate the address, hand it out, and watch the inbox. If the other side rejects the accented spelling, give them the xn-- form instead — it reaches the same mailbox.

Are the Unicode and xn-- forms two different addresses?

No. They are one address written two ways. Mail sent to either arrives in the same place.

Why does my browser show xn-- instead of the nice name?

As anti-spoofing protection. When a domain mixes alphabets in a way that could imitate another site, browsers show the unambiguous xn-- form so a look-alike cannot disguise itself.

Is a domain with xn-- automatically dangerous?

Not at all — plenty of legitimate businesses run internationalized domains. The danger is only when a domain pretends to be a well-known ASCII brand by swapping in look-alike letters. Judge it by whether the real name you expected should have needed encoding at all.

Generate an email address →

← Back to all docs