How Firefox Stops IDN Homograph Phishing Attacks

This article explains how the Mozilla Firefox web browser defends users against Internationalized Domain Name (IDN) homograph phishing attacks. It briefly covers the mechanics of Punycode spoofing, details Firefox's built-in algorithmic defenses that detect deceptive characters, and provides instructions on how users can manually configure the browser to always display raw Punycode for maximum security.

Understanding the Threat

An IDN homograph attack occurs when a malicious actor registers a domain name that visually resembles a legitimate domain, using different Unicode characters from non-Latin scripts (such as Cyrillic, Greek, or Hebrew). For example, the Cyrillic small letter "а" looks identical to the Latin small letter "a" in many fonts.

Behind the scenes, the Domain Name System (DNS) translates these non-ASCII characters into an ASCII-Compatible Encoding (ACE) format known as Punycode, which always begins with the prefix xn--. A phishing site might register xn--pple-43d.com, which the browser translates and displays in the address bar as apple.com.

Firefox’s Built-In Defenses

To prevent users from being tricked by visually identical characters, Firefox employs a strict set of rulesknown as an IDN Display Algorithm to decide whether to show the decoded Unicode (the visual script) or the raw Punycode (the xn-- format). If Firefox suspects a domain is attempting to spoof another, it falls back to displaying the safe Punycode version.

Firefox uses the following mechanisms to detect and block homograph attacks:

  • Script Mixing Detection: Phishing attacks often mix Latin characters with one or two Cyrillic characters. Firefox analyzes the scripts used within a single domain label. If a domain mixes characters from different scripts that do not belong together (such as Latin and Cyrillic), Firefox flags it as suspicious and displays the xn-- Punycode.
  • Character Restriction Levels: Firefox categorizes Unicode characters into different security profiles. It strictly blocks "confusable" characters—symbols that look like punctuation, slashes, or spaces—from being rendered as Unicode in the address bar.
  • Top-Level Domain (TLD) Whitelisting: Initially, Firefox maintained a whitelist of trusted TLD registries (like .com or .org) that had their own strict anti-spoofing policies. While Firefox now relies more heavily on its internal script-mixing algorithms, it still respects registry-level restrictions for country-code TLDs.
  • Same-Script Spoof Detection: Some attacks use entirely non-Latin scripts to mimic a Latin word (e.g., using only Cyrillic letters that happen to look like English letters). Firefox cross-references these domains against the user's preferred language settings and prohibited character lists to determine if the domain is attempting to mimic a Latin-script website.

How to Force Punycode Display in Firefox

While Firefox's automatic protections are robust, security-conscious users who only browse websites in standard Latin characters (like English) can completely eliminate the risk of IDN homograph attacks. Firefox allows you to disable Unicode domain rendering entirely, forcing the browser to always show the xn-- Punycode address.

To enable this protection manually:

  1. Open Firefox and type about:config into the address bar, then press Enter.
  2. Click the button to Accept the Risk and Continue.
  3. In the search bar at the top, type network.IDN_show_punycode.
  4. Locate the preference in the results. By default, its value is set to false.
  5. Double-click on the network.IDN_show_punycode row (or click the toggle icon on the right) to change its value to true.

Once set to true, Firefox will immediately cease translating internationalized domains into visual scripts. Any website utilizing non-Latin characters will immediately reveal itself in the address bar with the xn-- prefix, neutralizing the visual deception required for a homograph phishing attack to succeed.