Free, browser-based utilities for everyday developer workflows

Punycode URL Checker

Security Tools

Convert IDN hostnames and xn-- domains locally so you can inspect the visible URL, the ASCII host, and spoofing indicators before you trust them.

  • Paste a suspicious link, sender, domain, raw header, or copied message text.
  • The tool automatically detects the input type and runs local checks.
  • No URL is fetched, opened, or rendered as a clickable result.
Runs locally

Inspect suspicious content

Runs in your browser. Your pasted content is not sent to a server.

Not sure? Just paste it above. We will detect it automatically.

Safe example gallery

How to use the Punycode URL Checker

Paste a URL or hostname to compare the visible text with the ASCII and Punycode forms. This helps you spot domain tricks without opening the page.

What it does

  • Highlights hostnames that use xn-- labels or hidden Unicode forms.
  • Compares visible and ASCII hostname forms for mismatch clues.
  • Surfaces misleading URL structure and suspicious host labels.

When to use it

  • A link contains a hostname you cannot read at a glance.
  • You suspect a Punycode or IDN look-alike is hiding a fake site.
  • You need to check whether a URL is using a misleading hostname.

How to use it

  1. Paste the URL or hostname into the input.
  2. Add a trusted domain if you want a local comparison.
  3. Click Analyze locally and inspect the visible and ASCII hostname fields.
  4. Use the Unicode evidence panel for the character-level breakdown.

FAQ

  • Does this tool fetch suspicious links? No. All analysis runs locally in your browser and the tool does not open or fetch pasted URLs.
  • Can I paste raw email headers? Yes. Paste raw headers and the inspector checks From, Reply-To, Return-Path, Authentication-Results, and related spoofing indicators locally.
  • Does the inspector send my input to a server? No. Everything stays in your browser. Nothing you paste is sent to a server or third-party API.
  • What kinds of spoofing does it look for? It looks for invisible characters, bidi controls, mixed scripts, confusable domains, Punycode hostnames, misleading subdomains, credential-in-URL tricks, and sender mismatches.
  • Can it compare a suspicious value against a trusted domain? Yes. You can enter an optional trusted domain so the inspector can compare the pasted content against a known-good brand or host locally.

Related guides