Punycode Encode

Encoders & Decoders

Encode international domain names to Punycode (xn--)

Unicode Domain

Punycode (ACE) Domain

How to Use This Tool

Enter your input

Paste or type the text, URL, or data you want to encode or decode into the input panel on the left.

Instant result

The encoded or decoded output appears immediately in the right panel without any delay.

Copy the result

Click the "Copy" button to copy the output to your clipboard, ready to use in your code or application.

Download if needed

For longer outputs, use the Download button to save the result as a text file.

About This Tool

Punycode Encode is a free, instant, browser-based tool that encode international domain names to punycode (xn--). Encoding and decoding are essential operations in modern software development. Whether you're working with APIs, building authentication systems, handling URLs, processing file uploads, or debugging data pipelines, you'll constantly encounter the need to encode or decode data in various formats.

This tool runs entirely in your browser using standard Web APIs and JavaScript. No data is ever transmitted to a server, making it safe to use with sensitive content. There are no usage limits and no sign-up required.

Encodings like Base64 are used extensively in HTTP Basic Auth headers, data URIs for embedding images in HTML and CSS, JSON Web Tokens, email attachments (MIME), and binary data transmission over text-based protocols. URL encoding is required whenever you include special characters in query strings or path segments. HTML entity encoding prevents XSS vulnerabilities by escaping characters that have special meaning in HTML.

Understanding encodings is also critical for debugging — many data corruption issues in web applications trace back to double-encoding, missing decoding steps, or character set mismatches. This tool lets you quickly check what an encoded string actually contains, or verify that your encoding logic produces the expected output.

Punycode Encode converts internationalized domain names (IDNs) containing non-ASCII characters to their ASCII-compatible encoding (ACE) format. This is necessary when working with domain registrars, DNS libraries, or email systems that require ASCII-only hostnames.

Why Use This Tool?

Common pitfalls and gotchas

The mistakes that come up repeatedly when working with encoders & decoders tools — most of them invisible until they cause production failures or silent data corruption.

Double-encoding URL parameters
URLs that pass through multiple intermediaries sometimes get encoded twice — `%20` becomes `%2520`. Decode once and check whether the result still contains percent-encoded sequences before declaring the URL clean. Encoding is not idempotent: encoding an encoded string does not recover the original.
Treating Base64 as encryption
Base64 is encoding, not encryption. Anyone can decode a Base64 string back to its original bytes — there is no key, no security. JWT payloads are Base64-encoded but signed with a separate key; the encoding is for transport, not secrecy. Never store passwords, secrets, or PII as Base64.
Mismatched UTF-8 versus Latin-1 in encoders
Older encoders default to ISO-8859-1 (Latin-1); modern ones default to UTF-8. Encoding a UTF-8 byte sequence as Latin-1 produces mojibake — `é` becomes `Ã©`. Always specify the encoding explicitly when working across systems whose defaults you can't verify.

Frequently asked questions

Why does Base64 make my data 33% larger?

Base64 represents 3 bytes of binary data using 4 ASCII characters — that's where the 33% overhead comes from. The trade-off is universal compatibility: Base64 transmits cleanly through text-only channels (email headers, JSON strings, URL parameters) where raw binary would break.

Is URL encoding the same as URI encoding?

Functionally yes for most use cases, but URI encoding is the more general term defined by RFC 3986. JavaScript's `encodeURIComponent()` is what you usually want for query parameters; `encodeURI()` preserves URL structure characters and is wrong for individual values. Use `encodeURIComponent()` unless you specifically need URL-structure preservation.

How do I know if a string is encoded or not?

URL-encoded strings contain `%` followed by two hex characters. Base64 contains only A-Z, a-z, 0-9, +, /, and trailing `=` padding. HTML entities start with `&` and end with `;`. None of these are foolproof — a base64 string can coincidentally look like normal text — so explicit context (HTTP header type, JSON field, etc.) is more reliable than guessing.

Will encoding protect against XSS attacks?

HTML entity encoding is one part of XSS defense — it prevents user input from being interpreted as markup. URL encoding helps with attribute-context injection. But encoding alone isn't enough: use a Content Security Policy, validate input at the boundary, and use framework-level escaping (React's automatic escaping, Vue's v-html caution, etc.) for layered defense.

Related Tools

Base64 Encode

Encode text or files to Base64 format

Base64 Decode

Decode Base64 encoded strings back to plain text

URL Encode

Percent-encode special characters in URLs

URL Decode

Decode percent-encoded URL strings

HTML Entity Encode

Convert characters to HTML entities

HTML Entity Decode

Convert HTML entities back to characters