1. [Home](https://www.toolcomb.com/) 2. [Security Tools](https://www.toolcomb.com/security-tools) 3. URL Parser # URL Parser - Inspect Query Parameters & Rebuild Links Parse URLs into protocol, host, port, path, hash, and editable query parameters. Rebuild links and copy JSON - free, private, browser-only URL query builder. ### Paste URL _https://…_ Parse URL Protocol _https:_ Hostname _example.com_ Port Pathname _/path_ Hash _#section_ Username Password ### Query parameters Add _key_ _value_ _key_ _value_ ### Rebuilt URL ``` https://example.com/path?foo=bar&baz=1#section ``` Copy URL Copy JSON ### Reading and Rebuilding a URL: A Practical Example Consider `https://shop.example.com:8443/search?q=blue%20shoes&page=2#results`. The protocol is `https:`, the hostname is `shop.example.com`, the port is `8443`, and the pathname is `/search`. The query contains two values: `q` is `blue shoes` and `page` is `2`. The fragment is `#results`. After parsing, edit the `page` row to preview a different page number. The rebuilt query may display the space as `+` instead of `%20`. Although both commonly represent a space in form-style queries, exact character representation can matter to signed links and systems that compare URLs byte for byte. Avoid editing a presigned URL unless its issuer explains how to regenerate the signature. Some links repeat a parameter, such as `?tag=red&tag=blue`. Both rows are retained in the rebuilt URL. Copy JSON uses an object for query parameters, so only the last value for a repeated key appears there. For an accurate list of repeated parameters, use the table or copy the rebuilt URL instead. Need to examine a single percent-encoded value? Use the [URL Decoder and Encoder](https://www.toolcomb.com/url-decoder). If a query value contains a token, the [JWT Decoder](https://www.toolcomb.com/jwt-decoder) can help inspect its readable sections; decoding does not verify a signature. For an API response in JSON, continue with the [JSON Formatter](https://www.toolcomb.com/json-formatter). Before sending a rebuilt address or JSON snapshot to a colleague, remove credentials, access tokens, and personal information. The JSON's password field is masked, but the included rebuilt URL can still contain a password or secret query value. ## What is a URL parser and query builder? A URL (Uniform Resource Locator) identifies a resource on the web with a structured string: scheme, authority (host and port), path, query string, and fragment. Browsers, fetch, curl, and backend routers all parse the same components, but debugging OAuth callbacks, webhook signatures, and CDN cache keys is easier when you can see each part broken out instead of staring at one long line. The query component (?key=value&foo=bar) carries data such as search terms and campaign tags. Duplicate keys, empty values, and plus-versus-%20 encoding can affect how a destination reads a link. The editable table helps you inspect or change query parameters before copying the rebuilt URL. Internationalized domain names can appear in their ASCII-compatible form (xn--) when a URL is serialized. The hostname, protocol, and port fields help you inspect the address, but parsing does not verify TLS certificates or HSTS settings. Default ports may be omitted from the displayed port. Fragments (#section) are client-only in traditional navigation - they are not sent to the server on HTTP requests. Single-page apps abuse fragments for routing history; knowing which part is hash vs path prevents misconfigured reverse proxies that strip the wrong segment. Rebuilding a URL from parts validates mental models: change pathname alone for route testing, bump port for local docker-compose, or rebuild query from scratch when converting POST bodies to GET bookmark links (with caution on length limits and sensitive data in logs). ToolComb’s URL parser separates an address into editable fields and query rows, then displays a rebuilt URL. Copy the URL or a JSON snapshot when needed. Parsing runs locally; remove credentials and sensitive query values before sharing either output. This is not a URL validator for SSRF defense lists or a WHATWG conformance suite. Malformed inputs show clear errors; successful parses follow modern browser behavior including automatic https assumption when you omit the scheme for convenience. Open Redirect vulnerabilities often hinge on subtle URL parsing differences between frameworks. Security engineers decompose attacker-controlled URLs into components to see whether javascript: schemes, userinfo smuggling, or double slashes bypass naive blocklists. Surfacing protocol and hostname separately makes it obvious when a string is not https before it reaches server-side redirect logic. Analytics teams strip PII from query strings before logging. Parsing UTM parameters into editable rows lets you delete email or user id keys, rebuild a shareable link, and paste the redacted href into documentation. The JSON export fits ETL pipelines that store structured URL parts in BigQuery or Snowflake VARIANT columns. Single-page applications using hash routing (/#/dashboard) keep path-like segments in the fragment. Backend servers that log only pathname miss those segments - splitting hash helps frontend and backend teams align on what appears in access logs versus what the client router reads. IPv6 literals appear bracketed in URLs (https://[2001:db8::1]/). The URL API preserves them in hostname; manual string splitting often breaks on colons inside the address. Paste full IPv6 URLs here instead of guessing colon boundaries. Default ports disappear from href display (443 for https) but explicit :8443 testing URLs need port fields editable for local Kubernetes ingress experiments. Rebuild lets you bump port without retyping the entire marketing link with twenty tracking params. Webhook signatures sometimes cover pathname plus sorted query canonicalization. Developers copy parsed searchParams into test vectors to match HMAC implementations in Stripe, Slack, or custom gateways - consistency in percent-encoding order matters, and rebuilding via URLSearchParams aligns with browser encoding rules. Userinfo components (https://user:pass@host/) still appear in legacy systems and misconfigured clients. Surfacing username and password fields separately helps security reviews find credentials embedded in URLs before they land in access logs, browser history, or Referer headers on downstream HTTP requests. Paths can be normalized during parsing: for example, dot segments may be resolved. Inspect the displayed path and rebuilt URL rather than assuming the original spelling is preserved. This tool cannot determine how a server or proxy will route a request. The editable rebuild workflow is intended for hierarchical web addresses. Other schemes can parse differently or may not rebuild as expected, so use a dedicated inspector for non-web URLs. Internationalized path characters may appear percent-encoded in the pathname field. The displayed serialization can differ from the address you pasted, even when it identifies the same resource; check exact bytes when a system requires an exact match. ## How to parse and rebuild URLs Paste a URL at the top; parts populate below. Edit fields or query rows to see the rebuilt link update. 1. **Paste the URL** Enter an absolute URL with its scheme and hostname. For ordinary hostnames without a scheme, the tool attempts to add https://. 2. **Select Parse URL** Select Parse URL to populate the protocol, hostname, port, path, fragment, and query parameter fields. 3. **Inspect and edit the parts** Review the fields and change a component or query row if needed. Use Add to add a query parameter or the trash button to remove one. 4. **Review and copy the result** Check the rebuilt URL, then select Copy URL or Copy JSON. Remove sensitive values before sharing either output. ## Example: OAuth redirect URI ### Before https://app.example.com/callback?code=abc&state=xyz&utm_source=newsletter ### After Separate pathname /callback from query code, state, and utm_source. Edit state for CSRF testing; strip utm_* before logging. Never log full URLs containing secrets - copy only the parts you need. ## URL parser use cases ### 1. Marketing UTM inspection Verify campaign, medium, and source params before analytics go live. ### 2. API gateway debugging Split path from query when matching route templates in Kong or AWS API Gateway. ### 3. Webhook testing Rebuild signed callback URLs with rotated query tokens. ### 4. Cache key review Inspect query parameters that a cache configuration may include in its key; the Vary header concerns request headers, not query parameters. ### 5. Security reviews Spot javascript: or data: schemes and credential embedding in user-supplied links. ### 6. Documentation Export JSON parts into OpenAPI server variable examples. ### 7. SAML and OIDC redirect debugging Identity flows bounce through redirect_uri with state and nonce query params. Parsing lets you confirm exact param names, detect double-encoding of return URLs, and rebuild a clean callback for local IdP simulators without retyping long encoded strings. ### 8. Affiliate and referral link cleanup Marketing passes long query strings; product teams strip partner params before storing canonical product URLs in databases. Editable rows make it obvious which keys survive storage versus which were ephemeral campaign tags. ### 9. Reverse proxy path routing Ingress rules match path prefixes while microservices care about stripped paths. Splitting pathname helps document whether /api/v1/users stays intact or becomes /users at the upstream after rewrite annotations. ## URL vs URI vs URN Developers mix terms; parsing focuses on hierarchical URLs. | Term | Typical use | This tool | | --- | --- | --- | | URL | Web addresses with scheme | Full support via URL API | | URI | Broader identifier | URLs are URIs | | URN | Name without location | Not designed for reliable rebuild | | Relative path | /foo?bar=1 | Needs base - paste absolute URL | For relative URLs in HTML, resolve against document.baseURI in code. ## Limits - Assumes https when scheme omitted - may differ from curl defaults or server-side parsers expecting relative input. - Does not resolve DNS, check certificate validity, or follow HTTP redirects - pure string decomposition and rebuild. - Query parameter order follows table row order when rebuilding; some servers treat order as significant for legacy reasons. - Repeated query keys are preserved in the rebuilt URL, but Copy JSON keeps only the last value for each repeated key. - Very long URLs (many kilobytes of query) may hit browser textarea or clipboard limits before networking limits. - Does not percent-decode pathname or hash for display separately - shows URL API serialization behavior. - javascript:, data:, and file: schemes parse if supplied explicitly but are not recommended for untrusted input workflows. - Password field in UI is for completeness of URL API; storing passwords in URLs is deprecated and unsafe. ## Privacy Parsing and rebuild logic run entirely in your browser; pasted URLs are not uploaded to ToolComb for analysis. Presigned cloud URLs and session tokens in query strings remain visible in the page until cleared - avoid screen sharing while those fields are populated. Copy JSON masks the separate password field, but its rebuilt href can still include the password and sensitive query values. Remove credentials and review the entire output before sharing. Browser history and sync features may remember values depending on extensions - clear fields after handling OAuth secrets. No server-side logging of href components is performed by this tool’s client-side implementation. ## Frequently Asked Questions ### How does the URL parser work? It separates an address into protocol, hostname, port, pathname, fragment, optional username and password, and query key-value pairs. You can edit those fields and inspect a rebuilt URL locally in your browser. ### Are query parameters editable? Yes. Each query key and value appears in an editable table row. Add rows with the plus control, delete with trash, and watch the rebuilt href update live. Empty keys are skipped on rebuild to avoid trailing ampersand artifacts. ### Is the URL fragment sent to the server? No. The fragment (hash) is not sent in HTTP request-target lines to the origin server in typical navigation. It is available to client-side routers and analytics scripts in the browser. SPA frameworks may store routes after # while server access logs only see the path before the hash. ### What if I omit https://? If the input has no detected scheme, the page attempts to prepend https://. For predictable results, include the full scheme and hostname, particularly for ports, relative paths, or non-HTTPS addresses. ### Can I copy JSON of all parts? Copy JSON exports fields including protocol, hostname, pathname, query parameters, and the rebuilt href. Although the separate password field is masked, the href may still contain embedded credentials. Duplicate query keys also collapse to one value in the JSON object. Remove secrets and review the output before sharing it. ### Does the tool follow redirects? No network I/O occurs. Redirect chains (301/302 Location headers) are not resolved; paste each URL from the chain separately if you need to compare before and after redirect targets. ### How do relative URLs work? This tool does not provide a base URL for resolving relative paths. It may interpret a relative input as a hostname after adding https://, so resolve it against the correct base first and paste the full absolute URL. ### Is my URL uploaded to a server? No. Parsing and rebuild happen locally in JavaScript. Internal admin URLs, presigned S3 links, and staging OAuth callbacks stay on your device. ### How are duplicate query keys handled? The rebuilt URL preserves repeated nonempty keys as separate query rows. Copy JSON exports query parameters as an object, so repeated keys collapse to their last value there; use the rebuilt URL when you need to preserve all values. ### Is the URL parser free? Yes. Unlimited parses with no registration. ### Why does rebuilt encoding differ slightly from my original paste? Rebuilding applies form-style query serialization, which can represent spaces as + and change percent-encoding. The resulting string may look different from the original; check the destination's requirements before using it in a signature or exact-match comparison. ### Can I parse URLs with embedded credentials? Yes, userinfo before @ in authority is shown in username and password fields for debugging legacy systems. Do not log or share rebuilt URLs that still contain passwords; remove credentials before copying href into tickets. ## Related tools - [URL Encoder/Decoder](https://www.toolcomb.com/url-decoder) - Percent-encode individual strings. - [JWT Decoder](https://www.toolcomb.com/jwt-decoder) - Parse tokens in Authorization URLs. - [HTTP Status Codes](https://www.toolcomb.com/http-status-code-reference) - Debug redirect responses. - [Hash Generator](https://www.toolcomb.com/hash-generator) - Hash canonical URL strings. ## Related Tools Discover more free tools that might help with your next task. [Base64 Encoder Encode and decode Base64 data Use Tool](https://www.toolcomb.com/base64-encoder) [URL Decoder Decode URL-encoded strings Use Tool](https://www.toolcomb.com/url-decoder) [HTML Encoder Encode and decode HTML entities Use Tool](https://www.toolcomb.com/html-encoder) [Hash Generator Generate MD5, SHA1, SHA256 hashes Use Tool](https://www.toolcomb.com/hash-generator) [UUID Generator Generate v1, v3, v4, and v5 UUIDs Use Tool](https://www.toolcomb.com/uuid-generator) [Password Generator Generate secure random passwords Use Tool](https://www.toolcomb.com/password-generator) ### Related guides Read the how-to, then come back to this tool when you are ready to run it locally. - [MIME Types and HTTP Status Codes - Quick Browser Reference Look up Content-Type suffixes, decode 4xx vs 5xx in logs, and parse URLs and user agents locally when debugging APIs without tab-hopping.](https://www.toolcomb.com/blog/mime-types-and-http-status-codes-quick-reference) [View All Tools](https://www.toolcomb.com/tools)