URL Parser & Encoder

Break a URL into its parts, decode the query string into readable pairs, and percent-encode or decode any component.

Converter Converters & Formatters Runs in your browser
Try:

Result

Scheme
https
Host
tools.netvorx.pro
Port
8443
Path
/category/ip-subnetting/
Query parameters
3
Fragment
results

Query string

ParameterDecoded valueEncoded
qsubnet masksubnet%20mask
page22
tagv4v4

Details

Origin
https://tools.netvorx.pro:8443
Username
user
Password
(present - see warning)
Normalised URL
https://user:pw@tools.netvorx.pro:8443/category/ip-subnetting/?q=subnet%20mask&page=2&tag=v4#results
Credentials in URL
This URL embeds credentials. Browsers strip them from many contexts and proxies frequently log the full URL - never put credentials in a URL.

About URL Parser & Encoder

URLs pack six components and an arbitrarily nested query string into one line. Breaking them apart matters when you are debugging a redirect chain, an OAuth callback or a signature computed over a canonical URL.

Where URL parsing goes wrong in security code

Redirect and webhook validators routinely accept a URL, check that it starts with an expected host, and get bypassed. https://trusted.example.com@evil.test/ has the host evil.test, and https://evil.test/?x=trusted.example.com passes a naive substring test. Always parse the URL and compare the parsed hostname exactly, never the raw string. The same rule applies to SSRF defences, where a parsed host must also be resolved and checked against internal ranges.

encodeURI or encodeURIComponent

encodeURIComponent escapes everything that is not unreserved - including /, ?, & and = - and is what you want for a single parameter value. encodeURI preserves URL structure and is for encoding a whole URL. Using the wrong one either breaks the URL or lets an injected & add parameters you did not intend.

Common use cases

  • Reading a long OAuth or SSO callback URL.
  • Encoding a value that contains spaces or ampersands for a query string.
  • Checking which port a URL will actually connect to.

Edge cases and gotchas

  • A plus sign means space in form encoding but is literal in a path - the two contexts differ.
  • Fragments are never sent to the server; a value there is client-side only.

Frequently asked questions

Are URL fragments sent to the server?
No. Everything after the # stays in the browser, which is why OAuth implicit flow put tokens there, and why server logs cannot show you a fragment.
Why does my decoded value contain a %?
It was double-encoded: %2520 decodes to %20, which decodes again to a space. Decode twice, then fix whatever encoded it twice.