Separation of ASCII characters

First, all ASCII characters in the string are copied from input to output, skipping over any other characters. For example, "bücher" is copied to "bcher". If any characters were copied, i.e. if there was at least one ASCII character in the input, an ASCII hyphen is appended to the output (e.g., "bücher" → "bcher-", but "ü" → "").

Note that hyphens are themselves ASCII characters. Thus, they can be present in the input and, if so, they will be copied to the output. This causes no ambiguity: if the output contains hyphens, the one that got added is always the last one. It marks the end of the ASCII characters.

Encoding the non-ASCII characters

For each non-ASCII character in the input, the encoder calculates two numbers:

• i is the 0-indexed position of the non-ASCII character in the input string (e.g. "0" means that the non-ASCII character is the input string's first character).
• n is the numeric code point, in Unicode, of the non-ASCII character, minus 127 (the last character code of ASCII).

The encoder then calculates i*n, and encodes the resulting number into a sequence of base-36 digits. It renders those in ASCII, and appends the result to the output string.

The ASCII rendering is: 0 → 'a', ..., 25 → 'z', 26 → '0', ..., 35 → '9', with the number's digits arranged in little-endian order.

The base-36 encoding process is more complex. It outputs variable-length integers. These have the property that each number's most significant digit (e.g. the digit "1" in the number "123") is recognizable without context. Thus, the digits from multiple numbers can be concatenated, with nothing separating them, yet the original numbers can still be recognized and extracted.

ACE prefix for internationalized domain names

To prevent hyphens in non-international domain names from triggering a Punycode decoding, the string xn-- is prepended to Punycode sequences in internationalized domain names. This is called ACE (ASCII Compatible Encoding).^[2]

Thus the domain name "bücher.tld" would be represented in ASCII as "xn--bcher-kva.tld".

The decoder

The decoder is a finite-state machine with two state variables i and n.

i is an index into the string, ranging from zero (representing a potential insertion at the start) to the current length of the extended string (representing a potential insertion at the end). i starts at zero.

n starts at 128 (the first non-ASCII code point).

The state progression is a monotonic function. A state transition either increments i or, if i is at its maximum, resets i to zero and increments n. At the next state transition, we resume incrementing i. At each state, the code point denoted by n either gets inserted or not.

The numbers generated by the encoder represent how many possibilities to skip before an insertion is made.

There are six possible places to insert a character in the string "bcher" (including before the first character and after the last one). There are 124 code points between the last ASCII code point (127 = 0x7F, the end of ASCII) and "ü" (code point 252 = 0xFC, see Unicode's Latin-1 Supplement). There is one insertion position for the "ü" that must be skipped (position zero: before the 'b').

Thus, the decoder will skip a total of (6 × 124) + 1 = 745 possible insertions before reaching the required one. Once the character is inserted, there are now seven possible places to insert another character.

Re-encoding of code numbers as ASCII sequences

Punycode uses generalized variable-length integers to represent these values. For example, this is how "kva" is used to represent the code number 745:

A number system with little-endian ordering is used which allows variable-length codes without separate delimiters: a digit lower than a threshold value marks that it is the most-significant digit, hence the end of the number. The threshold value depends on the position in the number and also on previous insertions, to increase efficiency. Correspondingly the weights of the digits vary.

In this case a number system with 36 symbols is used, with the case-insensitive 'a' through 'z' equal to the decimal numbers 0 through 25, and '0' through '9' equal to the decimal numbers 26 through 35. Thus "kva", corresponds to the decimal number string "10 21 0".

To decode this string of symbols, a sequence of thresholds will be needed, in this case it's (1, 1, 26, 26, ...).^[3] The weight (or place value) of the least-significant digit is always 1: 'k' (=10) with a weight of 1 equals 10. After this, the weight of the next digit depends on the first threshold: generally, for any n, the weight of the (n+1)-th digit is the weight of the previous one times (36 − threshold of the n-th digit). So the second symbol has a place value of 36 minus the previous threshold value, in this case, 35. Therefore, the sum of the first two symbols 'k' (=10) and 'v' (=21) is 10 × 1 + 21 × 35. Since the second symbol is not less than its threshold value of 1, there is more to come. However, since the third symbol in this example is 'a' (=0), we may ignore calculating its weight. Therefore, "kva" represents the decimal number (10 × 1) + (21 × 35) = 745. The thresholds themselves are determined for each successive encoded character by an algorithm keeping them between 1 and 26 inclusive.^[4] The case can then be used to provide information about the original case of the string.^[5] Because special characters are sorted by their code points by encoding algorithm, for the insertion of a second special character in "bücher", the first possibility is "büücher" with code "bcher-kvaa", the second "bücüher" with code "bcher-kvab", etc. After "bücherü" with code "bcher-kvae" comes codes representing insertion of ý, the Unicode character following ü, starting with "ýbücher" with code "bcher-kvaf" (different from "übücher" coded "bcher-jvab"), etc.

To make the encoding and decoding algorithms simple, no attempt has been made to prevent some encoded values from encoding inadmissible Unicode values: however, these should be checked for and detected during decoding.

Punycode is designed to work across all scripts, and to be self-optimizing by attempting to adapt to the character set ranges within the string as it operates. It is optimized for the case where the string is composed of zero or more ASCII characters and in addition characters from only one other script system, but will cope with any arbitrary Unicode string. Note that for DNS use, the domain name string is assumed to have been normalized using nameprep and (for top-level domains) filtered against an officially registered language table before being punycoded, and that the DNS protocol sets limits on the acceptable lengths of the output Punycode string.