Punycode is an ASCII-compatible encoding for Unicode domain names. It converts non-ASCII characters, such as accented letters or characters from other writing systems, into a DNS-safe form that uses only standard letters, numbers, and hyphens. For example, a human-readable internationalized domain name can be stored and resolved in DNS as a punycode label beginning with xn--.
In cyber security, punycode matters because browsers and phishing defenses must decide whether to display the Unicode form or the encoded ASCII form. Attackers abuse this boundary with lookalike domains that use confusable characters to imitate trusted brands. If a browser shows the friendly Unicode version, a spoof may look legitimate at a glance; if it falls back to punycode, the name is usually easier to spot as suspicious. Defenders use this behavior in anti-spoofing controls, mixed-script warnings, brand monitoring, and exact-origin checks in password managers.