What it is
Internationalized Domain Names (IDN) are website addresses that include non-ASCII characters - like accented letters or scripts such as Arabic, Cyrillic, Chinese, or Hindi. They let people use domains in their native languages instead of being limited to A–Z, 0–9, and hyphens.
Why it matters
IDNs improve accessibility and branding for global users. But they also introduce look-alike risks where different characters appear identical, enabling homograph tricks that mimic trusted domains.
How it works
-
Your typed name is converted to an ASCII form called Punycode (starts with
xn--). -
Browsers display the human-friendly script if it meets safety rules.
-
Registries set policies to limit mixed scripts and reduce spoofing.
Red flags
-
A familiar site that looks right but shows a strange certificate or region.
-
A URL that copies a brand yet contains characters from multiple scripts.
-
Copy-paste of the address changes to
xn--...Punycode unexpectedly.
Prevent it
-
Bookmark important sites and use those bookmarks.
-
Hover to preview links and check the certificate before logging in.
-
Turn on browser settings or extensions that always show Punycode.
-
Use MFA so a fake login cannot steal access on its own.
IDNs are legitimate, but visual checks are weak
An IDN lets a domain use characters from languages beyond basic Latin. Browsers convert the label to an ASCII-compatible form that commonly begins with xn--. The technology is not malicious, but visually similar characters can support a homograph lure. Before signing in or paying, inspect the full hostname, certificate owner where available, and destination reached after redirects. Open important services from a saved bookmark instead of an email link. Compare this risk with typosquatting and follow the phishing response steps if credentials were entered.