URL Parser
Paste any link to see how a browser reads it: protocol, host, port, path, every query parameter decoded in a table, and the #fragment. The parser also shows what the browser changes in your URL and warns about phishing tricks such as google.com@evil.example.
https:// is assumed.Building a URL from parameters instead? Query String Builder →| # | Name | Value |
|---|
How a URL Is Built
Seven parts, and the rules for reading them.
A URL such as https://user@shop.example.com:8443/blog/post?id=42&tag=red#reviews has up to seven parts: the scheme (https), optional user info (user), the host (shop.example.com), an optional port (8443), the path (/blog/post), the query (id=42&tag=red) and the fragment (reviews). The fragment is never sent to the server; the browser keeps it to scroll the page or for app routing.
This tool uses your browser's own URL parser, which follows the WHATWG URL Standard, the rules that Chrome, Firefox, Safari, Edge and Node.js all follow. What you see here is how a browser actually reads the link, including the corrections it makes: lower-casing the host, removing a default port such as :443, resolving /./ and /../ and percent-encoding spaces.
Query parameters. Each name=value pair is decoded: %26 becomes &, %C3%A9 becomes é, and + becomes a space (the HTML-form rule used by URLSearchParams, PHP, Django and most frameworks). Some APIs treat + as a real plus sign; switch off Read + as a space to read their URLs.
Safety checks. Everything before an @ in the address is just a user name, so https://paypal.com@evil.example/ opens evil.example. The parser flags this, look-alike international domains (xn--), domain endings that don't exist (.con, checked against the official IANA list), passwords in links, private network addresses and tracking parameters.
URL Parts at a Glance
What each part is called in JavaScript (new URL()).
| Part | JavaScript property | Example | Notes |
|---|---|---|---|
| Scheme | protocol | https: | Always lower-case; includes the colon. |
| User info | username, password | user, pa55 | Rare and risky; browsers warn about it. |
| Host | hostname | shop.example.com | International names become xn-- Punycode. |
| Port | port | 8443 | Empty when it's the default (80 for http, 443 for https). |
| Host + port | host | shop.example.com:8443 | |
| Origin | origin | https://shop.example.com:8443 | Used for CORS and the same-origin policy. |
| Path | pathname | /blog/post | Starts with / for web URLs. |
| Query | search, searchParams | ?id=42&tag=red | Sent to the server. |
| Fragment | hash | #reviews | Not sent to the server. |
How to Use the URL Parser
Get your result in under ten seconds.
Paste a URL
From the address bar, an email, code or a log file.
Read the parts
Each component, decoded and colour-coded, with the parameters in a table.
Check and copy
Review the warnings, then copy the normalised URL or the JSON.
Why Use the URL Parser on Developers Web Tools
Fast, accurate and private — built for developers.
Browser-exact
Uses the same WHATWG parser as Chrome, Firefox, Safari and Node.js.
Decoded parameters
Every name and value decoded, repeated names and broken encoding flagged.
Phishing checks
Fake hosts before an @, look-alike international domains, unknown endings.
Shows the changes
See exactly what the browser corrects: case, default port, ./ and ../, encoding.
Copy as JSON
All parts and parameters in one object, ready for code or tests.
Private
Parsed in your browser. Nothing is uploaded, stored or logged.
Frequently Asked Questions
hostname is just the name, such as example.com. host adds the port when one is written: example.com:8080. If the port is the default for the scheme (443 for https), browsers drop it, and host equals hostname.
HTML forms send a space as +, and URLSearchParams, PHP, Django, Rails and Express decode it that way. Some APIs and signed URLs treat + as a literal plus sign and expect a space as %20. For those, switch off Read + as a space.
Browsers clean up URLs before using them: they lower-case the scheme and host, remove a default port, resolve /./ and /../, turn backslashes into slashes in web URLs, add a / for an empty path and percent-encode spaces and other characters. The list under the box explains every change it found.
It's Punycode, the ASCII form of an international domain name. xn--mnchen-3ya.de is münchen.de. Attackers sometimes register names with letters that look Latin but aren't (Cyrillic а instead of a), so the parser shows both forms and warns about mixed scripts.
No. Everything after # stays in the browser. It's used to scroll to a section, by single-page apps for routing, and by text fragments (#:~:text=) that highlight a phrase.
The parser assumes https:// and tells you so. A link starting with // (protocol-relative) also gets https:. Paths starting with /, ? or # are shown as a relative URL, with the parts that would come from the page they're used on left empty.
No. The URL is parsed by your browser on this device. It is never sent anywhere, stored or logged, which matters because links often contain tokens or personal details.