URL Parser
Break any URL into protocol, credentials, host, port, path, query parameters and fragment, decoded, using the same URL parser as browsers and Node.js.
Free · No sign-up · Your inputs stay in your browser
Input
Break a URL into its parts
Output
api.example.com
| Protocol | https: |
|---|---|
| Username | user |
| Password | s3cret |
| Hostname | api.example.com |
| Port | 8443 |
| Origin | https://api.example.com:8443 |
| Path | /v2/orders/1042 |
| Query | ?expand=items&expand=customer&utm_source=newsletter |
| Fragment | #summary |
| Path segments | v2 · orders · 1042 |
| Query key | Decoded value |
|---|---|
| expand | items |
| expand | customer |
| utm_source | newsletter |
Parsed by the WHATWG URL standard that browsers and Node.js use. PHP's parse_url() follows RFC 3986 instead and disagrees on edge cases, such as a backslash in the path or a username containing @.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Two standards
Browsers and Node.js follow the WHATWG URL Standard; PHP's parse_url() and many older libraries follow RFC 3986. They agree on ordinary URLs and disagree on edge cases such as backslashes, spaces and an @ in the username, which is exactly what URL-based attacks exploit. When a server checks a URL that a browser will later follow, parse it the way the browser will.
Connection strings are URLs
Database DSNs like postgres://user:pass@host:5432/db?sslmode=require parse the same way, which makes this a quick way to check a DATABASE_URL. A password containing @, : or / must be percent-encoded in the URL.