URL Parser

Break down any URL into its individual components: protocol, host, port, path, query parameters, hash, and more.

runs locally on your browser. Your data never leaves your device.

Common Use Cases

Inspect an API endpoint URL to verify the base path, query parameters, and authentication credentials before making a request
Extract the origin from a third-party URL to configure the correct CORS policy on your server
Debug a redirect URL to check that tracking parameters and UTM codes are properly encoded and present
Parse a database connection string URL to extract the host, port, database name, and credentials for configuration

About URL Parser

A URL (Uniform Resource Locator) is a reference to a web resource that specifies its location on a computer network and a mechanism for retrieving it. Defined in RFC 3986, a URL is composed of several distinct parts, each serving a precise purpose. The scheme (protocol) identifies the access mechanism: HTTP for plain web traffic, HTTPS for encrypted traffic, FTP for file transfers, and dozens of others. The authority section, comprising an optional username and password, the host, and an optional port, tells the client where to connect and how to authenticate.

The path component identifies the specific resource on the server, following the same hierarchical structure as a Unix file system. The query string, introduced by a question mark, carries additional parameters as key-value pairs separated by ampersands. Query strings are how web applications pass state to servers: they power search terms, pagination, filters, tracking codes, and API parameters. The fragment identifier, prefixed by a hash, is never sent to the server; it is processed entirely by the browser to scroll to an element or update client-side routing in single-page applications.

Understanding URL structure is essential for web development, API integration, security analysis, and debugging. Developers routinely need to inspect URLs to verify routing, check parameter encoding, debug authentication headers embedded in connection strings, or extract the origin for CORS configuration. Security researchers analyse URLs to detect open redirects, parameter injection vectors, and subdomain takeover candidates.

The browser's native URL API (window.URL / WHATWG URL Standard) provides a spec-compliant, encoding-aware parser that correctly handles international domain names, percent-encoded characters, and non-standard port numbers. Using it means edge cases such as trailing slashes, empty query strings, and IPv6 literal addresses are handled exactly as browsers handle them.

Frequently Asked Questions

What is the difference between host and hostname?
The 'host' property includes the port number when it is explicitly present in the URL, for example 'example.com:8080'. The 'hostname' property always omits the port, returning just 'example.com'. When no port is specified, both return the same value.
Why does the port field show 'default' instead of a number?
HTTP defaults to port 80 and HTTPS defaults to port 443. When a URL uses these standard ports, browsers and the URL API omit them from the port field, so 'https://example.com' has an empty port because 443 is implied. Showing 'default' makes this explicit rather than leaving the field blank and confusing.
What is the origin and why does it matter?
The origin is the combination of scheme, hostname, and port, for example 'https://example.com:8080'. It is the fundamental unit of the browser's same-origin policy, which controls which pages can access each other's resources and cookies. Two pages share an origin only if all three components match exactly.
Why is the hash/fragment not sent to the server?
The fragment identifier (#section) is a browser-only concept. When a browser makes an HTTP request it strips everything after the # before sending the URL to the server. Fragments are used to scroll to an anchor element on the page, or in single-page applications as a routing mechanism that doesn't trigger a server request.
Can I parse URLs with credentials (username and password)?
Yes. Some URLs, especially database connection strings, FTP addresses, and internal service URLs, embed credentials in the format 'scheme://user:password@host/path'. The parser extracts these from the authority section. Passwords are masked by default in this tool; click the eye icon to reveal them. Embedding credentials in URLs is generally discouraged for public-facing resources.
What happens with percent-encoded characters in query parameters?
The URL API automatically decodes percent-encoded sequences when exposing query parameter values, so '%20' becomes a space, '%2B' becomes '+', and '%E2%82%AC' becomes '€'. This is the decoded value the server application receives. The raw encoded form is still visible in the full query string field.

Related Tools

View all Developer Tools

Base64 Encoder/Decoder

Encode text to Base64 or decode Base64 back to plain text in real-time.

JSON Formatter

Paste JSON to auto-format, validate, and spot errors with inline highlighting.

URL Encoder/Decoder

Encode or decode URLs and query strings in real-time, both directions.