You've probably seen a domain like 한글.com show up as an odd xn-- string in a browser address bar or email header. Here's what that is and why it exists.
What Punycode is
The domain name system (DNS) was designed to support only ASCII characters. Punycode is the encoding devised to safely convert internationalized domain names (IDN) — containing Korean, Chinese, Arabic, and other Unicode scripts — into ASCII that DNS can handle. For example, "한글.com" becomes "xn--bj0bj06e.com".
Why it starts with xn--
xn-- is the ACE (ASCII Compatible Encoding) prefix, a standard marker (RFC 3492) indicating that what follows is a Unicode domain encoded in Punycode. Browsers recognize this prefix and decode it back to the original script for display.
Where this comes up in practice
You'll run into this when checking the source of an unfamiliar xn-- domain in an email header, when registering an internationalized domain in a server config like nginx (which needs the ASCII form), or when an SSL certificate's Common Name uses the Punycode form.
Spotting phishing with it
Some Unicode characters look nearly identical to Latin letters (Cyrillic, for instance), which enables "IDN homograph attacks" — a fake domain like "аpple.com" using a Cyrillic 'а'. Converting a suspicious domain to Punycode reveals its real character makeup, helping you judge whether it's legitimate.
More guides
🔁
How to Find a Domain's IP Address
Find the real server IP a domain points to
🛰️
How to Check DNS Propagation (What Is TTL?)
Understand TTL and check propagation after a nameserver change
📡
The Easiest Way to Find Your IP Address
Public vs private IP, and how to check yours
📐
CIDR Notation and How to Calculate a Subnet Mask
Convert CIDR notation like /24 into a subnet mask
🩺
How to Check an SSL Certificate's Expiration Date
Check a certificate's expiry without opening a browser
🪪
Understanding JWT Structure and How to Decode It
The Header, Payload & Signature — explained
🗝️
How to Create an Apache .htpasswd File for Basic Auth
Generate an APR1-MD5 hashed .htpasswd file
🔑
What Makes a Strong Password (and How to Generate One)
Length, character sets & entropy explained
🔐
What Is Base64 Encoding and When to Use It
Why it's used in email attachments & data URIs
📘
Using a JSON Formatter to Read API Responses
Turn minified JSON into something readable
🗓️
How to Convert a Unix Timestamp to a Date
Turn seconds-since-1970 into a readable date
🗃️
How to Format Messy SQL Queries
Break a one-line SQL statement into readable clauses
🎨
Converting Between HEX, RGB, and HSL Color Codes
The difference between the three formats
🔠
camelCase, snake_case & Other Naming Conventions
When to use each naming style
🆚
How to Compare Two Text Files (Diff Checker)
Quickly spot differences between two versions
🔤
What Is Punycode?
The encoding that makes internationalized domain names (IDN) safe for ASCII-only DNS.
🔀
Converting IPv4 to IPv6
What that ::ffff:192.168.1.1 entry in your logs actually is.
🕸️
Extracting Domains From Text
Pulling just the domains out of mixed text like logs or emails.
🚪
Opening Multiple URLs at Once
Stop clicking through your daily site list one at a time.
📮
Verifying an Email Address
What format checks and MX records can confirm — and what they can't.
📋
Inspecting HTTP Response Headers
Cache policy, server details, and compression, all from one set of headers.
🛡️
Checking Security Headers
HSTS, CSP, X-Frame-Options — and the risk of skipping each one.
📇
Looking Up Domain Info With WHOIS/RDAP
Who registered it, when, and when it expires.
📍
Finding a Rough Location From an IP
How it works, how accurate it really is, and why a VPN changes the answer.
🖼️
Checking OGP Meta Tags
What to check when a share card on social or chat apps looks wrong.
📑
Checking Heading Structure (h1–h6)
The foundation of SEO and accessibility — a clean heading hierarchy.
🏷️
Checking TITLE & META Tags
The tags that decide how a page appears in search results.
#️⃣
What Is a Hash Function?
Which hash to use when, and what "can't be reversed" actually means.
📱
How QR Codes Work
Why they still scan when partly covered, and how QR phishing works.
🔍
Reading SSL Certificate Fields
What CN, SAN, issuer, and validity period each mean.
📜
What Is a CSR?
Why getting an SSL certificate starts with generating a CSR.
♻️
PEM vs DER Certificate Format
Why the same certificate sometimes needs to be re-encoded.
🤝
When Cert and Key Don't Match
How the check works, and what usually causes a mismatch.
🪄
Using a Self-Signed SSL Certificate
Fine for testing and dev — never for production. Here's why.
🔑
HTTP Basic vs Bearer Auth
How the Authorization header value is built, and which scheme fits which case.
🎫
Generating Secure Random Tokens
How long should an API key or session secret be, and in what format?
🔒
Encrypting Config Values With Jasypt
How the ENC(...) value in application.properties actually works.
🧩
What Is JSON String Escaping?
Safely putting text with quotes or newlines into a JSON value.
✨
Formatting vs Minifying JS/CSS
Format while you work, minify when you ship — and why they pull in opposite directions.
✂️
How Far Minification Should Go
Stripping whitespace is always safe — renaming variables can break things.
🧽
Why HTML Indentation Matters
You can't spot a mistake in a structure you can't see.
🧹
When to Reformat XML
Seeing the element nesting in a single dense line of XML.
🔣
What Are HTML Entities?
Showing literal <, >, and & characters on the page.
📊
Turning a Spreadsheet Into an HTML Table
From copy-paste straight to HTML — no tags typed by hand.
⛓️
Extracting Links From HTML
Pulling out every href and src value at once.
🐘
The Limits of PHP/MySQL Syntax Checkers
What a bracket/quote check can confirm — and what it can't.
🗄️
When a MySQL Pairing Check Helps
Catching mistakes in long subqueries and dynamically built queries.
🔍
Common HTML5 Validation Errors
Mismatched tags, duplicate ids, missing alt — why each one matters.
✍️
When to Use a Visual HTML Editor
Where WYSIWYG wins, and where writing code by hand wins.
📝
Why Markdown Preview Matters
What the raw code hides that the rendered result reveals.
🔗
What Is URL Percent-Encoding?
Why a space or non-ASCII character turns into something like %20 or %EC%95%88.
✏️
Find & Replace With Regex
For replacements a plain search can't do.
↕️
What to Know Before Sorting a List
Why alphabetical and numeric order don't behave the same way.
📧
Extracting Emails From Text
The regex pattern, and the false positives that trip people up.
🔢
Why Character Count ≠ Byte Count
Why one Korean character can take up 3 bytes.
🔤
What Are Fullwidth and Halfwidth Characters?
Why something that looks like a digit doesn't match in search.
🈚
What Is a Unicode Code Point?
The unique number behind every character, and how to read U+XXXX.
🔟
How Text Converts to Numbers
Decimal, hex, binary — the same value, written three ways.
🧾
UTF-8 Byte Encoding Basics
Why English takes 1 byte and Korean takes 3.
0️⃣
How Text Becomes 0s and 1s
What a bit is, and how text turns into bits.
🔡
How ASCII Art Is Made
Drawing large letters out of nothing but characters.