URL Parser guide
Paste a long tracking link or a broken redirect and see every piece laid out: host, port, path, fragment, and each query parameter decoded on its own row.
Anatomy of a URL
Take https://[email protected]:8443/products/shoes?color=red&size=10#reviews. It looks like one string, but a browser reads it as a set of labeled parts, and so does this parser.
Protocol (scheme) is https:, including the colon. Username is user, the rare credentials section before an @. Hostname is shop.example.com. Port is 8443. Host is hostname plus port: shop.example.com:8443. Origin is protocol plus host, https://shop.example.com:8443, which is the unit browsers use for security rules like CORS and cookies. Pathname is /products/shoes. Search is the query string, ?color=red&size=10. Hash is the fragment, #reviews, which never gets sent to the server at all; it stays in the browser.
Below those fields, the parser lists every query parameter on its own row, with percent-encoding decoded. A parameter written q=caf%C3%A9%20au%20lait shows as q = café au lait.
Why it uses the browser's own parser
Splitting URLs with regular expressions is a well-known source of bugs, including real security holes where a filter and a browser disagree about which host a link points to. This tool hands your text to the URL parser built into your browser, which follows the WHATWG URL Standard. That is the same code that decides where a link actually goes when you click it, so what you see here is what Chrome, Firefox, or Safari will do.
The standard also normalizes as it parses. https://Example.COM:443/a/../b comes out as https://example.com/b: the hostname is lowercased, the default port 443 is dropped, and the ../ is resolved. International domain names are converted to Punycode, so münchen.de shows up as xn--mnchen-3ya.de. When the port field is empty the parser tells you the default the browser will use: 443 for https, 80 for http.
If you paste a bare domain like example.com/page, the tool assumes https:// in front. Text that still cannot be parsed, such as a hostname containing a space, shows an error rather than a half-guessed breakdown.
Worked example: auditing a tracking link
A newsletter link lands you on https://shop.example.com/sale?utm_source=newsletter&utm_medium=email&utm_campaign=fall&utm_campaign=Fall-2026#top. The parser lists five query rows. utm_campaign appears twice, once as fall and once as Fall-2026. That is a bug worth catching: GA4 and many servers will read only one of them, and which one depends on the tool. Duplicates are always listed separately here, in the order they appear, so they cannot hide.
Second example: a login redirect, https://app.example.com/login?next=https%3A%2F%2Fapp.example.com%2Fbilling%3Ftab%3Dinvoices. The next row decodes to https://app.example.com/billing?tab=invoices, so you can confirm the redirect target without decoding it by hand. If that target were on a different domain, you would be looking at a possible open-redirect problem.
Safe for suspicious links
The parser never fetches, previews, or follows the URL. Nothing is requested from the site, so you can paste a phishing link from a spam email and inspect it without tipping off the sender or loading anything.
When you do, read the hostname, not the whole string. In https://paypal.com.account-verify.example.net/login, the hostname ends in example.net. Everything before that is a subdomain the attacker controls. A username section is another trick: https://[email protected]/ has a username of www.bank.com and a hostname of evil.example.
Common gotchas
A # inside a value truncates the query. In ?note=size#10, everything from # on is the hash, not part of note. Encode it as %23.
Unencoded & splits parameters. ?title=Salt&Pepper produces two keys, title = Salt and Pepper with an empty value. Use the URL encoder on values before you assemble links.
Trailing slashes matter to servers. https://example.com/docs and https://example.com/docs/ are different paths, and many sites redirect one to the other. If a link returns a 404 or an extra redirect hop, compare the pathname field character by character.
Paths are case-sensitive even though hostnames are not. example.com/About and example.com/about can be different pages, which is why redirects and canonical tags matter for SEO.
Use the copy button to grab the full breakdown as text when you are filing a bug report or handing a link audit to a teammate.
How we calculate: sources
Frequently asked questions
What are the parts of a URL?
In https://shop.example.com:8443/path?tag=a#reviews: protocol is https:, hostname is shop.example.com, port is 8443, host is both together, pathname is /path, search is ?tag=a, and hash is #reviews. Origin is protocol + host.
What is the difference between host and hostname?
Hostname is the domain alone (example.com). Host is the hostname plus the port when a non-default port is used (example.com:8080). On a normal https URL on port 443 they are identical.
Why is the port blank or shown as default?
The URL standard drops the port when it is the scheme's default: 443 for https and 80 for http. The parser shows the default so you know which port the browser will actually use.
Does it handle duplicate query parameters?
Yes. ?tag=a&tag=b is listed as two separate rows, tag = a and tag = b, in the order they appear. Many servers read only the first or the last, so duplicates are worth spotting.
Do I need to include https://?
No. If you paste example.com/page without a scheme, the parser assumes https:// so you still get a full breakdown.
Does the parser visit or fetch the URL?
No. It never makes a network request. It only splits the text you paste, so it is safe to use on internal, expired, or suspicious links.
Is my data private?
Everything runs in your browser. Nothing you enter is uploaded to a server or stored by us.
Is the hash (#fragment) sent to the server?
No. Browsers keep everything after # on the client. Servers and access logs never see it, which is why single-page apps and anchor links use it.
What is a URL origin?
The combination of protocol, hostname, and port, like https://example.com. Two URLs with the same origin can share cookies and read each other's data; different origins are isolated by the browser.