@privacybrowser Been a while since I checked the source code of it but if I remember correctly: It displays human-readable punycode/percent-encoded characters, unless there is known homographic characters (which are probably identified via ICU).

It's not great (like an hostname entirely in greek/cyrillic ought to be human-readable), but I would say it's safe enough.

The only real way to be safe anyway is by using bookmarks and an integration of password managers which matches on the hostname (because you don't always remember the exact spellings of websites).

While I'm at it: Consider using a font like monospace for URLs.