URL Parser / Inspector

See every component of any URL — host in punycode and Unicode, decoded query table, homograph check — entirely on this device.

0 bytes uploaded

waiting for input

Input — paste a URL, or one URL per line for a batch

URL components

The component table appears here when you paste a URL.

Query parameters appear here when the URL has a query string.

0 B · 0 lines · waiting for input

Press ? for shortcuts

Do it offline:$ trurl --json "https://shop.example.com:8080/a/b?x=1&x=2"

How to use it

Paste a URL, or several one per line; surrounding whitespace is trimmed with a notice.
Read the table: host in punycode and Unicode, port beside its default, path segments decoded, query parameters as rows with repeats kept.
For a relative reference, open the base-URL field and paste the base; the resolved address arrives with each step listed.
Copy any component with its own button, or take the whole breakdown as JSON.

Paste any URL and read it as a table: scheme, host in punycode and Unicode, port beside its scheme default, path segments decoded, each query parameter on its own row, fragment. A confusable-script check flags lookalike hosts, base-URL resolution lists every step, and batch mode reads one URL per line. Nothing you paste is sent anywhere.

How it works

Read https://user@shop.example.com:8080/a/b?x=1&x=2#frag left to right: the scheme ends at the colon, user is userinfo ended by the @, shop.example.com is the host, 8080 overrides the 443 https implies, /a/b is two path segments, x=1&x=2 is two parameters sharing one name, and the fragment frag stays in the browser.

RFC 3986 supplies the grammar; the WHATWG URL Standard defines what browsers actually do. This page runs the WHATWG algorithm, the parser behind your address bar, so the table shows what a browser sees.

Hosts carry non-ASCII differently: an internationalized label travels as ASCII under the xn-- prefix (RFC 3492 Punycode). Both forms are shown and every character is classified by script — a Cyrillic letter inside a Latin label raises a labeled warning. A flag means look closer; silence is not proof a link is safe.

Examples

https://user@shop.example.com:8080/a/b?x=1&x=2#frag

scheme    https
username  user
host      shop.example.com
port      8080 — default for https is 443
origin    https://shop.example.com:8080
path      /a/b
query     x = 1 · x = 2 (x ×2)
fragment  frag

The userinfo ends at the @, the explicit 8080 stands beside the https default 443, and both x parameters keep their order — repeated keys are data, not a defect.

https://xn--pple-43d.com

punycode  xn--pple-43d.com
unicode   аpple.com
warning   Possible homograph: 'а' (U+0430 Cyrillic) looks like Latin 'a' — this host may be imitating a different domain.

The registered form xn--pple-43d.com decodes to a host whose first letter is Cyrillic а (U+0430), not Latin a — identical in most fonts. The warning names the exact character.

../img/x.png

Parse the base URL → https://example.com/docs/
Merge the reference with the base directory (RFC 3986 §5.2.3) → /docs/../img/x.png
Remove dot segments (RFC 3986 §5.2.4) → /img/x.png
Resolved URL → https://example.com/img/x.png

Resolution per RFC 3986 §5.2: the ../ climbs out of /docs/ before img/x.png is joined, and every step is listed beside the result.

Every example on this page is executed against the same engine that powers the tool, on every build.

Gotchas worth knowing

mailto:, tel: and data: have no host

The table switches to what each scheme really has: address for mailto:, number for tel:. A data: URL shows its declared MIME type and payload size; decoding it is the Base64 Decoder's job, one link away.

IPv6 brackets, and the two meanings of @

In https://[2001:db8::1]:8443/ the brackets keep the address's colons from reading as a port — here it is 8443. Only a raw @ marks userinfo; an escaped %40 inside a value is ordinary data.

%2520 means the encoding ran twice

When a decoded parameter still holds valid escapes, the callout says so, offers the next pass, and counts the depth — your pasted URL is never rewritten. The full story of how pipelines mint %2520 belongs to the URL Decoder, one link away.

Credentials in URLs are deprecated and leak into logs

A user:password@ pair travels in plain sight through proxies, server logs and browser history. The table reports only that a password is present — the value is never printed, copied or shared.

The 2,048-character rule is folklore

No standard caps URL length, but old Internet Explorer stopped near 2,083 characters and some proxies still refuse long requests. Anything past 2,048 characters earns a note — long SSO URLs work, yet break first in transit.

Common errors

Invalid URL — missing scheme. Did you mean `https://shop.example.com/a/b?x=1&x=2…`?: A bare hostname is not a URL yet. The suggestion is offered only because the same input genuinely parses with https:// in front; accepting it re-runs the parse under an https:// assumed chip, and your text stays untouched.
This input cannot be parsed as a URL — the parser reported: Invalid URL: The parser's own verdict is preserved beneath the summary. Here the space inside the host is fatal, and the usual origin is a URL split across lines by an email client; rejoining the pieces repairs it.
Input is larger than the 1 MB limit for this tool. For bigger batches use the CLI: trurl --json --url-file urls.txt: The whole input is declined rather than partly parsed — row numbers in a truncated batch would point at the wrong lines. trurl reads a file of any size locally; without it, python3's urllib.parse does the same job.

FAQ

Is a domain with xn-- dangerous?

Not by itself — xn-- is how internationalized domain names are stored in ASCII, and most are legitimate. Trouble starts when the decoded form imitates a familiar name using another script's lookalike letters, so the page classifies every character and flags the mix.

Why does the port show 443 when my URL has none?

Every scheme implies a default — 443 for https, 80 for http, 21 for ftp — and a URL without an explicit port uses it. The row prints the default marked as implied.

Is a repeated query parameter an error?

No — the standard permits repeats and frameworks read them as lists, so the table keeps every occurrence in order and marks the name with a count instead of collapsing it.

Does a URL I paste here leave my browser?

No. Parsing, punycode decoding, the script check and batch runs all happen in this tab — no upload, no account. URLs routinely carry session tokens and reset links; the safest inspector never transmits them.

Keyboard shortcuts

⌘/Ctrl + Enter: Re-run the parse now, in any mode.
⌘/Ctrl + S: Download the breakdown as .json — downloads rather than saving the page.
⌘/Ctrl + C: With nothing selected, copy the JSON breakdown; a selection still copies itself.
⌘/Ctrl + Shift + C: Force-copy the JSON breakdown, selection or not.
t: Next theme (single-key; idle in text fields, honors the kill switch).
? or ⌘/Ctrl + /: Open the shortcut help, including the ⌘S conflict note.
Esc: Close the topmost overlay; focus returns to its opener — never the input.

Nothing you paste here leaves this tab. State only ever travels in links you explicitly create.

URL Standard (WHATWG) — URL parsing · RFC 3986 — URI Generic Syntax, §5.2: Relative Resolution · RFC 3492 — Punycode · UTS #39 — Unicode Security Mechanisms (confusables)

Last reviewed: 2026-07-29