URL parser

What a URL parser tells you that reading the string cannot

A link looks like one thing and is really nine, glued together by punctuation that does double duty. The colon separates the scheme, but a colon also introduces a port and can sit harmlessly inside a path. The at sign marks the end of the credentials, unless it is part of an email address in a parameter. A slash starts the path, except for the two that open the authority. Reading a long link by eye means holding all of those rules in your head at once, and the moment the link is three hundred characters of tracking parameters it stops being possible.

This page hands the job to the same parser your browser uses. Paste a link, and every component is pulled out and named: the scheme, the user name and password if there are any, the host, the host name on its own, the port, the origin, the path, the query string and the fragment. Nothing is guessed, because nothing needs to be — the rules for taking a URL apart are written down, and the browser already implements them.

Every component, including the ones that are not there

Absent parts get a row too, and that is not padding. A missing port is the single most common source of confusion when a link works in one place and not another, because absence means a default rather than nothing: an https link with no port written connects on 443 regardless. A link with no query string has no parameters, which sounds obvious until you are staring at a redirect chain wondering which hop dropped them. And the origin — scheme, host and port taken together — is the exact triple that decides whether two pages share cookies and storage, so seeing it spelled out settles arguments that otherwise run for an afternoon.

Credentials get flagged rather than hidden. If someone hands you a link with a name and a password sitting in front of the host, that is worth knowing about, because the string travels intact through every chat log and bookmark it passes through even though browsers strip it before sending the request.

Two columns for every parameter, and why both matter

The query table shows each parameter twice: exactly as it appears in the string, and decoded. The first column is what a server receives. The second is what a person meant. They differ more often than they agree, and the gap between them is where the interesting bugs live.

Repeats keep their own rows. A link carrying two parameters with the same name is not a mistake to tidy away — it is a real thing that happens when a redirect appends a value that was already present, and which of the two a server reads is that server’s decision. A tool that merged them would be answering a question it cannot answer. A name with no equals sign is likewise distinct from a name with an equals sign and nothing after it: the first is a flag, the second is an explicitly empty value, and plenty of software treats them differently.

Then there is the plus sign, which means a space in a query string and a plus sign everywhere else in the same address. That is not a quirk of this tool; it is two specifications disagreeing about one character. A path ending in a folder named C++ and a search for two words separated by a space can be written with the identical byte. Each part is decoded by the rule that governs it, so you see both readings side by side rather than one guess. If the encoding itself is the thing you are chasing — double encoding, a truncated multi-byte character, a percent sign that was never an escape — the URL decoder is the tool built around that question, and it names each broken sequence and its position.

When the string is not a whole URL

Half the strings people paste into a parser are not absolute URLs, and “invalid URL” is a useless thing to say to any of them. A path pulled out of a server log, a protocol-relative script reference beginning with two slashes, a bare host name copied from a browser bar that hid the scheme, a query string on its own — each of these is a recognizable shape with a specific missing piece.

So the message names the shape and the gap. A bare host is told that no parser can choose between http and https on your behalf, and is offered a concrete string to try instead. A path is told that it only means something next to the address it belongs to. A space inside a host gets its exact position. Nothing is corrected silently: a suggestion is a button, and pressing it writes the suggestion into the box where you can keep editing it.

What the parser changed on the way, and what this page will not claim

Taking a URL apart also normalizes it, and the changes are worth seeing rather than absorbing. Host names are compared without regard to case. A host outside plain ASCII is converted to its Punycode form, because that is what goes on the wire and what a certificate is issued for. A port that matches the scheme default disappears. Dot segments resolve. Each of those is listed when it happens, next to the string you typed, so you can tell which one explains the difference you noticed.

One thing is deliberately absent. This page will not split a host into a domain and a top-level domain, because that cannot be done correctly by a rule — anyone can register a name under .co.uk, .com.au or github.io, and the only accurate source is a public list that changes continuously. A stale copy of that list splits hosts in the wrong place while looking exactly as confident as a correct one, and a silently wrong answer about a domain is worse than no answer. The host name is given whole, which is also the form DNS resolves and a cookie is matched against.

There is no fetching either. The destination is never contacted, so nothing here tells you whether the link works, where a shortener points, or what a redirect resolves to. Going the other way — assembling a campaign link rather than taking one apart — is the UTM builder, which keeps any parameters and fragment your destination already carries instead of overwriting them.

Why no server is involved

Taking an address apart is bookkeeping over characters. Locate the colon, locate the pair of slashes, locate the question mark and the hash, then turn hex pairs back into bytes and group the bytes into letters. There is no dictionary to consult and no model to run, which means a machine somewhere else has nothing to contribute that your own processor does not already do instantly. So none was built, and the script running on this page is the whole of the tool.

The consequence is worth stating plainly, because of what tends to sit inside the very parameters people want explained: one-time credentials, signed access keys, identifiers that grant a session. A string you paste here becomes a JavaScript value and nothing else. It is not transmitted, it is not appended to the location bar where it would survive in your history, and it is not saved by the page for later. Anyone who would rather confirm that than believe it can follow the guide to verifying local processing and watch the network panel while typing.