How network.IDN_show_punycode Forces Raw Punycode in Firefox

This article provides a complete overview of how the network.IDN_show_punycode preference alters the way Mozilla Firefox displays Internationalized Domain Names (IDNs). You will learn the fundamental relationship between Unicode domains and the Domain Name System (DNS), how Firefox normally processes these addresses for user readability, and the exact mechanism by which enabling this preference bypasses standard decoding to expose raw xn-- ASCII strings in the address bar to prevent phishing attacks.

The Relationship Between IDNs and Punycode

The Domain Name System (DNS) is historically restricted to standard ASCII characters (letters A–Z, digits 0–9, and hyphens). To accommodate Internationalized Domain Names—which contain non-ASCII characters such as Arabic, Cyrillic, Chinese, or accented Latin letters—the internet relies on a translation system called Punycode.

Punycode converts Unicode strings into an ASCII-Compatible Encoding (ACE) format. Every Punycode domain segment begins with the prefix xn--, followed by the ASCII representation of the non-ASCII characters. For example, the German domain münchen.de is translated at the network level into xn--mnchen-3ya.de.

Firefox’s Default Rendering Process

By default, Firefox aims to provide a seamless user experience for international users. When you navigate to an IDN, the following process occurs:

  1. Input and Conversion: A user clicks a link or types a Unicode domain into the address bar.
  2. Network Resolution: Firefox converts the Unicode into its xn-- Punycode equivalent to query the DNS server, because the DNS server only understands the ASCII version.
  3. UI Decoding: Once the connection is being established, Firefox's User Interface (UI) layer translates the xn-- string back into the readable Unicode characters to display in the address bar.

While Firefox uses a complex set of rules and whitelists to detect malicious look-alike characters during this third step, some spoofing attempts can still slip through.

How network.IDN_show_punycode Alters the Process

The network.IDN_show_punycode setting is a boolean preference located within Firefox’s advanced configuration (about:config). By default, its value is set to false.

When you change the value of network.IDN_show_punycode to true, you directly modify step three of Firefox's rendering process. The preference acts as a strict override switch for the browser's UI layer. Instead of passing the domain name through the Punycode-to-Unicode decoder for display purposes, Firefox completely bypasses the decoding algorithm and renders the exact network-level ASCII string in the address bar.

Because the browser already has to generate the xn-- string to communicate with the DNS resolver, forcing this preference simply instructs the address bar, status bar, and tab titles to display the raw network data rather than the localized human-readable translation.

Why Users Force Raw Punycode Display

The primary reason to force xn-- strings is to defend against IDN homograph attacks. In a homograph attack, a malicious actor registers a domain using foreign characters that look identical to standard Latin characters. For example, the Cyrillic small letter "а" looks identical to the Latin small letter "a" in many fonts.

An attacker could register apple.com using Cyrillic characters. By default, Firefox might display this in the address bar as apple.com, tricking the user into believing they are on the legitimate website. However, with network.IDN_show_punycode set to true, Firefox skips the visual translation and immediately displays xn--pple-43d.com in the address bar, instantly exposing the deception.

How to Enable the Preference

To force Firefox to display raw Punycode strings for all internationalized domains, follow these steps:

  1. Open Firefox and type about:config into the address bar, then press Enter.
  2. Click the button to accept the risk and continue.
  3. In the search bar at the top, type network.IDN_show_punycode.
  4. Locate the preference in the results list. Its default state will be false.
  5. Double-click the row (or click the toggle icon on the far right) to change its value to true.

The change takes effect immediately without requiring a browser restart. All non-ASCII domains will now exclusively display their xn-- prefixes in the address bar.