Punycode Converter and IDN Homograph Checker

The mechanical half is the RFC 3492 bootstring algorithm, which converts a Unicode label to the xn-- form that appears in DNS, in certificates and in logs, and back again. That form is unreadable by design, so having it converted matters whenever an internationalised domain shows up somewhere that does not render it.

The half worth having is the homograph check. Cyrillic "а" at U+0430 and Latin "a" at U+0061 render identically in nearly every font, so a domain spelled with the Cyrillic letter looks exactly like the real one and is not. Browsers defend against this by showing the punycode instead — but the rules differ between them and depend on the script involved. Anywhere outside a browser address bar there is no defence at all: an email client, a terminal, a chat window, a log viewer will all render the lookalike happily.

So each label is checked for two things. Mixing scripts inside a single label is flagged, because legitimate domains essentially never do it and it is the signature of a name built to impersonate another. Individual characters that render as ASCII but are not — the Cyrillic and Greek lookalikes, and the several Unicode characters that render as a full stop — are named with their code points and what they resemble. The punycode form is shown alongside, because that is the representation in which the two names are obviously different.