Skip to content
koducathome

URL Parser

Split a URL into protocol, host, port, path, query parameters and fragment using the WHATWG URL standard.

How to use this tool

Steps for using the URL Parser.

  1. Paste a URL into the input, or click Sample to load one with credentials, a port, a path, repeated query keys and a fragment.
  2. The URL is parsed as you type. Press Parse URL or Enter to confirm.
  3. If the URL has no scheme (for example example.com/path), turn on Assume https:// to parse it as a web address.
  4. Read each component, the decoded path segments and the query parameter table; repeated keys are highlighted.
  5. Use Reveal to show a masked password, and Copy JSON or Download to export the components.

Example

Split a URL with a port, repeated keys and a fragment

URL
https://user:s3cret@api.example.com:8443/v1/users/42/orders?status=shipped&sort=date&tag=new&tag=sale&q=red%20shoes#summary
Components
protocol: https:
username: user
password: s3cret (masked until revealed)
hostname: api.example.com
port: 8443
host: api.example.com:8443
origin: https://api.example.com:8443
pathname: /v1/users/42/orders
path segments: v1, users, 42, orders
query: status=shipped, sort=date, tag=new (repeated), tag=sale (repeated), q=red shoes
hash: #summary

Common use cases

  • Debugging OAuth redirect URIs and callback URLs that fail an exact-match check.
  • Reading long tracking or affiliate links to see which parameters they carry.
  • Finding repeated query parameters that a backend might handle inconsistently.
  • Checking the real hostname behind an internationalised or suspicious-looking link.
  • Confirming which origin a URL belongs to when configuring CORS or cookies.

How URLs are parsed

This tool uses your browser's built-in URL class, which implements the WHATWG URL Standard — the same parser browsers use for links, fetch() and location. That means the result matches what your JavaScript sees, including normalisation: the scheme and host are lower-cased, default ports such as :443 for HTTPS are dropped, . and .. path segments are resolved, and characters that are not allowed are percent-encoded (a space becomes %20).

A URL breaks down into the protocol (scheme with a trailing colon), optional username and password, the hostname, an optional port, the pathname, the search (query string, starting with ?) and the hash (fragment, starting with #). host is hostname plus port, and origin is scheme + host + port — the unit browsers use for the same-origin policy and CORS. The fragment is never sent to the server; it is only used by the browser.

Query parameters are read with URLSearchParams, which decodes percent-escapes and treats + as a space, as HTML forms do. The same key can appear several times (tag=new&tag=sale); the table keeps every occurrence in order and highlights the repeats, because frameworks disagree on whether the first value, the last value or all values win. To convert a query string into a nested JSON object instead, use the Query String Parser.

Internationalised domain names are converted to punycode (xn--…) because DNS only supports ASCII. When a hostname contains xn-- labels, the tool decodes them back to Unicode so you can see what a link really points to — useful for spotting look-alike domains in phishing links. Input without a scheme, such as localhost:3000, is a classic trap: the standard parses localhost: as the scheme. The tool detects this and offers to assume https://.

Limitations

  • Relative URLs (like /path?x=1) cannot be parsed without a base; add a scheme and host first.
  • The parser normalises the URL, so the displayed href may differ from your input (default ports removed, characters encoded).
  • Query values are decoded as form data (+ becomes a space). Use the Query String Parser to keep + literal.
  • Parsing happens in your browser; the URL is never requested or sent anywhere.

Frequently asked questions

Why does the port disappear when I enter `https://example.com:443`?

443 is the default port for HTTPS, so the WHATWG parser removes it during normalisation. The tool notes which default port is in effect.

Why is `localhost:3000` parsed with the protocol `localhost:`?

Without //, the text before the first colon is a valid scheme name, so the standard treats it as one. Turn on Assume https:// or type http://localhost:3000.

What is the difference between host, hostname and origin?

hostname is just the domain or IP. host adds the port when one is given. origin is scheme + hostname + port, the security boundary browsers use for CORS, cookies and storage.

Is the fragment (#hash) sent to the server?

No. Browsers keep the fragment on the client. It is used for in-page anchors and by single-page apps for routing, but never appears in the HTTP request.

How should a server handle repeated query keys?

There is no single rule: some frameworks keep the first value, some the last, and some return an array. If you rely on repeated keys, check your framework's documentation and test with the API Tester.