Punycode
Also known as: RFC 3492, xn--, ACE prefix, ASCII Compatible Encoding
Punycode is the encoding defined by RFC 3492 that represents a Unicode string using only the letters, digits and hyphen that DNS allows, producing the xn-- labels that carry internationalised domain names.
Overview
DNS labels are restricted to letters, digits and the hyphen — a rule from the 1980s that predates Unicode and cannot be changed without breaking every resolver in existence. Punycode is the workaround: it rewrites a Unicode label into that restricted alphabet, and prefixing the result with xn-- marks it as encoded. So bücher becomes xn--bcher-kva, and every resolver in the path handles plain ASCII while the browser displays the original.
The encoding is an instance of Bootstring, and it is cleverer than escaping each character. The ASCII characters in the label are copied through unchanged and a hyphen separates them from what follows, which is why xn--bcher-kva still visibly contains 'bcher'. The non-ASCII characters are then appended not as code points but as a compressed sequence of insertion instructions — each one saying which code point to insert and where — with an adaptive bias that shrinks the encoding when the characters come from the same region of Unicode. That is why a Chinese label encodes far more compactly than a random mixture would.
Punycode alone is not enough to turn a domain into its xn-- form, and this is where implementations go wrong. UTS #46 requires a preprocessing pass first: case folding, mapping compatibility characters to their plain equivalents, and normalising to NFC. Skipping it produces plausible but wrong results — a decomposed 'café' encodes to xn--cafe-yvc instead of xn--caf-dma, a different domain — so a converter that calls a bare Punycode library disagrees with the address bar.
The encoding is also why homograph attacks are visible at all. Because Cyrillic а and Latin a are different code points, аpple.com encodes to xn--pple-43d.com, and browsers exploit that by displaying the xn-- form rather than the Unicode one whenever a name mixes scripts in a suspicious way. The ugly label is the security feature.