URL Parser

Introduction:

A URL often arrives as one long string, but it can contain several separate decisions: which URL family is being used, which host receives the request, whether credentials are embedded, which path is selected, which query parameters travel with it, and what fragment stays in the browser. Treating the whole string as a single address can hide the part that is actually causing a redirect, API mismatch, tracking leak, or support-ticket risk.

Safe link review usually starts before opening the link. A copied address may contain a signed download token, a private hostname, a misleading user-info section, a long tracking tail, a duplicate query key, or encoded delimiters that look harmless until decoded. Splitting the text into scheme, authority, path, query, and fragment gives a more reliable way to inspect the evidence without sending a request.

Query strings need special care because their rules are partly conventional. A key can appear more than once, a blank value can be meaningful, a valueless key can still be sent, and a plus sign may be decoded as a space in form-style parsing. Percent-encoded delimiters such as %26 and %3D can also hide what would otherwise look like extra separators.

A clean parse is evidence, not a safety verdict. A well-formed URL can still point to a phishing site, a private admin path, a signed object, or an application route that only works in one environment.

How to Use This Tool:

Use the parser as a local review workspace for one address or query string at a time.

1. Paste a full URL, host-like value, or query string into URL or query string. If several lines are pasted, only the first non-empty line is parsed and an ignored-lines warning appears.
2. Choose Input handling. Lenient URL adds a default secure web scheme to host-like text, Strict absolute URL rejects missing schemes, and Query string only parses parameters without scheme, host, path, or fragment rows.
3. Set Query values to decoded for reading, raw for percent-encoding review, or both when readable values and original encoded text need comparison.
4. Keep Sensitive values set to mask before sharing output. Adjust Token-like query keys when local conventions require extra key fragments to be hidden.
5. Use Advanced controls when rebuilding a review URL. Duplicate query keys, Sort rebuilt query keys, Drop fragment in review URL, and Show empty query values change the review copy rather than the original input.
6. Read URL Component Ledger, Query Parameter Ledger, and Inspection Notes before copying Rebuilt URL Text. Fix parse errors, decode issues, risky schemes, unexpected duplicates, or masking concerns before sharing the result.

Interpreting Results:

Start with scheme, hostname, host, port, and origin. These fields carry destination evidence that affects redirects, same-origin assumptions, public versus private environment mistakes, and whether a link behaves like a normal HTTP or HTTPS request.

The host-label row is only a simple split of the hostname. It does not infer public suffix ownership, domain registration, reputation, or whether a lookalike domain is safe.

• Use Query Parameter Ledger to inspect duplicate keys, empty values, valueless keys, masked sensitive values, and decode notes before trusting a rebuilt URL.
• Use Inspection Notes for the false-confidence checks: risky scheme, visible credentials, duplicate query rows, invalid percent encoding, encoded delimiters, fragment handling, and long URLs.
• Use Rebuilt URL Text as a review artifact. Sorting keys, dropping fragments, masking values, or keeping only one duplicate can change how another system interprets the address.
• A clean parse does not prove reachability, authorization, safety, or exact equivalence with a server framework, reverse proxy, browser extension, or application router.

Technical Details:

Modern browser URL parsing follows the living URL model, while many documents and server tools still use URI vocabulary from RFC 3986. The practical result is that spaces, percent-encoded bytes, host parsing, query encoding, and special schemes can differ across environments. A review copy should keep both the normalized component view and any warning that changes interpretation.

Query parsing is separate from the base URL shape. The query text is split on &, each row is split on the first =, plus signs are treated as spaces for form-style decoding, and invalid percent encoding falls back to the raw text with a review note. Duplicate keys remain visible even when the rebuilt URL policy keeps only the first or last occurrence.

Transformation Core:

Query Rule Core:

Length and Threshold Core:

The length profile counts characters in the parsed target and in the main URL parts. The inspection notes flag a normalized parse target longer than 2000 characters for review.

The host-label split is intentionally simple. It separates labels around dots, but it does not perform a public-suffix lookup, DNS lookup, reputation lookup, HTTP request, or availability check.

Privacy Notes:

Parsing happens locally in the browser. The result can still be sensitive if the pasted text contains credentials, signed URLs, session IDs, tracking identifiers, private hostnames, or internal paths.

• Leave masking enabled before copying output into support tickets, issue trackers, chat, screenshots, CSV, DOCX, or JSON.
• Revealing sensitive values makes them visible in copied tables, downloads, and rebuilt review text.
• The parser does not contact the destination URL, fetch DNS, check reputation, or validate whether the address is reachable.

Worked Examples:

FAQ:

Glossary:

Scheme

The protocol or URL-family label before the colon, such as https.

Authority

The part after // that can contain user information, hostname, and port.

Origin

The scheme, host, and port value used for same-origin comparisons.

Query string

The ? part that carries parameters such as filters, pagination, tokens, or tracking values.

Fragment

The # part used as a client-side secondary reference.

Percent encoding

A way to represent reserved or non-ASCII characters with percent-prefixed byte values.

Duplicate query key

A query key that appears more than once in the same query string.

Review URL

A rebuilt copy that follows the selected masking, duplicate, sorting, empty-value, and fragment policies.

References:

• URL Standard, WHATWG, last updated 1 June 2026.
• RFC 3986: Uniform Resource Identifier (URI): Generic Syntax, RFC Editor, January 2005.
• URL, MDN Web Docs.
• URLSearchParams, MDN Web Docs.
• Information exposure through query strings in URL, OWASP Foundation.
• How to get a hostname from a URL in Python, Simplified Guide.