{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

{{ badge.label }}{{ badge.value }}
Parsing is local and reactive. The rebuilt artifact is masked by default.
Use a pinned mode when host-like text or a valueless query key is ambiguous.
Auto detect is conservative and reports the resolved mode in the summary and inspection ledger.
This changes visible and exported query evidence, not the parsed key order.
Mask is the safer default for support tickets and shared diagnostics.
Preserve is neutral and matches ordinary URL query behavior.
Default: token, secret, password, key, auth, signature, session, jwt, and common click identifiers.
Off preserves source order and is the neutral default.
{{ sort_query ? 'On' : 'Off' }}
Off preserves the pasted fragment and is neutral.
{{ drop_fragment ? 'On' : 'Off' }}
On preserves the source faithfully and is neutral.
{{ include_empty_params ? 'On' : 'Off' }}
{{ analysis.reviewUrl }}
ComponentValueMeaningCopy
{{ row.label }}{{ row.value }}{{ row.detail }}
#KeyValueOccurrenceFormStateCopy
{{ row.index }}{{ row.key }}{{ row.value }}{{ row.occurrence }}{{ row.form }}{{ row.state }}
CheckStatusEvidenceNext stepCopy
{{ row.check }}{{ row.level }}{{ row.evidence }}{{ row.nextStep }}

The chart renderer is unavailable. Exact lengths remain available in the component and query ledgers.

Uniform Resource Locator (URL) Encoder Encode URL components, complete links, form values, or paths with context-aware percent escapes, UTF-8 byte details, and local query checks.
Uniform Resource Locator (URL) Decoder Decode percent-encoded URLs or text, inspect characters and query structure, and clean trackers or duplicate parameters without fetching the destination.
URL Encode and Decode Tool Encode or decode URL text by context, handle form-style plus signs and nested escapes, and check round-trip or double-encoding risks locally.
UTM URL Generator Build a campaign URL with consistent UTM tags while preserving useful query values and flagging naming, channel, or length issues.

A URL carries several kinds of information in one line. The scheme identifies the protocol family, the authority names the network endpoint, the path selects a resource, the query passes named values, and the fragment points to a client-side location. Treating the whole line as one opaque string makes troubleshooting difficult and can hide credentials or tokens in copied diagnostics.

PartExamplePractical meaning
SchemehttpsHow the resource is addressed.
Authorityapi.example.com:8443Optional credentials, hostname, and port.
Path/v1/ordersThe resource location within that authority.
Query?status=paid&tag=a&tag=bOrdered key occurrences, including repeats and empty values.
Fragment#summaryA client-side reference that is not sent in an HTTP request.

Query strings need occurrence-level reading. Repeated keys may represent a list, a sequence, or conflicting instructions. tag=a&tag=b cannot always be reduced to one value without changing meaning. An empty value such as debug=, a valueless key such as debug, and a missing key are also distinct shapes even when an application later treats them alike.

Percent encoding adds another boundary. A space in form-style query data is commonly written as +, while reserved or non-ASCII bytes may appear as percent triplets. Decoding helps a person read the value, but the raw spelling remains useful when a malformed escape, signature, or exact request needs investigation.

URLs are also a disclosure surface. Credentials in the authority and secrets in the query can enter browser history, logs, analytics, screenshots, referrer data, monitoring systems, and support tickets. Masking likely secrets before sharing is prudent, but a name-based mask cannot recognize every sensitive value or decide whether a URL is safe to visit.

Parsing explains structure; it does not establish trust. A plausible hostname is not proof of ownership, a parsed URL is not proof that a service exists, and a rebuilt URL is not authorization to request it.

How to Use This Tool:

Keep masking and occurrence preservation enabled for the first review, then change one policy at a time.

  1. Paste one URL, host-like value, or query string into URL or query string. Only the first nonblank line is parsed; additional lines produce a review note.
  2. Leave Mode on Auto detect unless the resolved shape is wrong. Pin Absolute URL, Host-like value, or Query string only to make the intended grammar explicit.
  3. Choose how query values, duplicates, empty entries, and token-like keys should appear. Keep Sensitive values masked when the rebuilt copy may leave the trusted session.
  4. Read the component and query evidence before copying Review URL. A Review finding for duplicates, malformed percent encoding, exposed secrets, ignored lines, or omitted empty values calls for a policy decision.

Interpreting Results:

The rebuilt value is a normalized review artifact, not a byte-for-byte copy. Host-like input gains an https scheme, default HTTP or HTTPS ports are omitted, query data is re-encoded in form style, and masking replaces selected values.

  • Check Resolved mode first because it determines whether scheme, host, path, and origin fields exist.
  • Read every duplicate occurrence before choosing first or last; the destination may depend on order or repeated values.
  • Switch to raw query display when a decoded row reports an invalid percent escape.
  • Do not treat a clean inspection list as a security verdict. The parser does not resolve DNS, check a public suffix, contact the site, follow redirects, or validate authorization.

Technical Details:

URL parsing separates structural delimiters before query-specific decoding. The query portion is then handled as an ordered list of occurrences rather than as a dictionary, which preserves evidence that would otherwise disappear when keys repeat.

Transformation Core

StageRuleObservable consequence
Select inputTake the first nonblank line, up to 8,192 characters.Extra nonblank lines are ignored and reported.
Resolve modeA leading scheme selects absolute URL; a leading ?/&, or text with =/& but no URL path or fragment delimiter, selects query; other input is host-like.Host-like input is parsed with an assumed https:// prefix.
Split URLSeparate scheme, authority, path, query, and fragment; lowercase the hostname and remove explicit port 80 for HTTP or 443 for HTTPS.An authority with no path receives /.
Read querySplit on &, then split each occurrence at its first =. Decode + as space and apply percent decoding.Invalid decoding keeps the original text and marks the occurrence for review.
Apply policiesOptionally remove empty values, keep all/first/last duplicate occurrences, mask token-like keys, and sort by decoded key.The query ledger still shows dropped rows and their original occurrence order.
SerializeEncode keys and values in form style, preserve or drop the fragment, and rebuild the URL or query.Spaces become +; normalized text may differ from the pasted spelling.

Rule Core

Duplicate handling compares decoded key text exactly and is case-sensitive. Preserve all occurrences keeps every row. Keep first occurrence retains the earliest row for each key, while Keep last occurrence retains the final row. Sorting happens after this selection and preserves original order between equal keys.

Sensitive-key matching is a case-insensitive substring rule. The default fragments cover token, secret, password, password shorthand, key, auth, signature, session, JWT, and common click identifiers. A matching query value becomes a length-bearing mask; authority credentials become masked placeholders. This protects only names caught by the list and can also mask a harmless key whose name happens to contain one of the fragments.

Input evidencePolicyRebuilt effect
tag=a&tag=b&token=sample&debug=Preserve duplicates, keep empty values, mask sensitive names.Both tags and the empty debug value remain; the token value is replaced before encoding.
The same queryKeep last duplicate and omit empty values.Only tag=b remains from the repeated tag, and debug= is removed.

Section-length figures count characters in parsed URL regions. They help locate an unusually long authority, path, query, or fragment but do not enforce a protocol, browser, proxy, or server limit.

Privacy Notes:

Parsing is local and does not make a network request to the pasted destination. Masking is enabled by default, but a non-default pasted source can appear in the current page address as editable state. Browser history, screen captures, copied links, downloads, and unmasked rebuilt URLs can therefore expose credentials, tokens, personal data, or tracking identifiers.

Before sharing, inspect both authority credentials and query keys. Customise the token-like fragments when the application uses secret names that the default list does not cover.

References: