URL Parser & Encoder
Break a URL into its parts, decode the query string into readable pairs, and percent-encode or decode any component.
Result
Query string
| Parameter | Decoded value | Encoded |
|---|---|---|
| q | subnet mask | subnet%20mask |
| page | 2 | 2 |
| tag | v4 | v4 |
Details
- Origin
- https://tools.netvorx.pro:8443
- Username
- user
- Password
- (present - see warning)
- Normalised URL
- https://user:pw@tools.netvorx.pro:8443/category/ip-subnetting/?q=subnet%20mask&page=2&tag=v4#results
About URL Parser & Encoder
URLs pack six components and an arbitrarily nested query string into one line. Breaking them apart matters when you are debugging a redirect chain, an OAuth callback or a signature computed over a canonical URL.
Where URL parsing goes wrong in security code
Redirect and webhook validators routinely accept a URL, check that it starts with an expected host, and get bypassed. https://trusted.example.com@evil.test/ has the host evil.test, and https://evil.test/?x=trusted.example.com passes a naive substring test. Always parse the URL and compare the parsed hostname exactly, never the raw string. The same rule applies to SSRF defences, where a parsed host must also be resolved and checked against internal ranges.
encodeURI or encodeURIComponent
encodeURIComponent escapes everything that is not unreserved - including /, ?, & and = - and is what you want for a single parameter value. encodeURI preserves URL structure and is for encoding a whole URL. Using the wrong one either breaks the URL or lets an injected & add parameters you did not intend.
Common use cases
- Reading a long OAuth or SSO callback URL.
- Encoding a value that contains spaces or ampersands for a query string.
- Checking which port a URL will actually connect to.
Edge cases and gotchas
- A plus sign means space in form encoding but is literal in a path - the two contexts differ.
- Fragments are never sent to the server; a value there is client-side only.