URL parser and query string editor

Runs locally

Split a URL into its parts, decode the query string and edit parameters.

URL

  • The query contains "+". URLSearchParams and HTML forms read it as a space; a server that decodes with decodeURIComponent keeps it as "+".

Parts

https://api.example.com:8443/v2/orders/%E2%82%AC-refunds?status=open&tag=vip&tag=eu&q=caf%C3%A9+latte&page=2#results

Protocolhttps:
Username—
Password—
Hostapi.example.com:8443
Hostnameapi.example.com
Port8443
Originhttps://api.example.com:8443
Path/v2/orders/%E2%82%AC-refunds
Query?status=open&tag=vip&tag=eu&q=caf%C3%A9+latte&page=2
Fragment#results

Path segments (decoded)

  1. 1v2
  2. 2orders
  3. 3€-refunds

Query parameters

5 parameters · values shown decoded

Rebuilt URL

https://api.example.com:8443/v2/orders/%E2%82%AC-refunds?status=open&tag=vip&tag=eu&q=caf%C3%A9+latte&page=2#results

Query as JSON

{
"status": "open",
"tag": [
"vip",
"eu"
],
"q": "café latte",
"page": "2"
}
Guide

A URL is parsed by rules, not by splitting on "?" and "&"

Most bugs with URLs come from reading them with string functions. Splitting on "?" breaks when the fragment contains one, splitting on "&" breaks when a value was not encoded, and a hand-written decoder gets "+" wrong half the time. This page uses the same WHATWG URL parser your browser uses for fetch() and the address bar, so what you see here is what the server will receive.

The query string is where the confusion lives. Parameter names can repeat (tag=a&tag=b is two values, not a typo), order is preserved and sometimes significant, and each value is percent-encoded independently. The parameter table shows every pair decoded, marks repeated keys, and rebuilds the query with correct encoding when you edit a row — so you can change a filter or strip a tracking parameter without hand-encoding anything.

Pasted URL

https://api.example.com:8443/v2/orders/%E2%82%AC-refunds?status=open&tag=vip&tag=eu&q=caf%C3%A9+latte#results

What the parser reads

host      api.example.com:8443
path      /v2/orders/€-refunds  (decoded)
status    open
tag       vip   (repeated)
tag       eu    (repeated)
q         café latte
fragment  #results

The "+" in q became a space because URLSearchParams and HTML forms read it that way. A server that decodes with decodeURIComponent would keep it as "+" — one of the warnings the tool raises.

Where people get caught

"+" means space only in the query

Form encoding (application/x-www-form-urlencoded) turns spaces into "+", so query parsers read "+" as a space. In the path, "+" is a literal plus. Encode a real plus in a query value as %2B.

Double encoding hides in plain sight

%2520 is an encoded %20: something encoded a value that was already encoded. The server then sees the text "%20" instead of a space. The tool flags %25 followed by hex digits for exactly this reason.

The fragment never reaches the server

Everything after "#" stays in the browser. Putting a token or a filter there means the server never sees it, and moving one out of the fragment into the query means it starts appearing in server logs.

Credentials in a URL leak everywhere

user:password@host works, but the URL ends up in browser history, proxy and server logs, and Referer headers. Browsers increasingly strip or block it. Use an Authorization header instead.

About the URL parser

How it works in 5 steps · 5 common use cases · 4 questions answered

How it works

  1. 1.Paste a URL. A bare host like example.com/path is read as https://.
  2. 2.Every part is listed: protocol, credentials, host, port, origin, path, query and fragment.
  3. 3.Query parameters appear decoded, one row each, with repeated keys marked.
  4. 4.Edit, add or remove rows; the rebuilt URL updates with correct encoding.
  5. 5.Copy the rebuilt URL, or the query string as a JSON object.

Common use cases

  • •Reading a long redirect or callback URL from a log line
  • •Stripping utm_ and other tracking parameters before sharing a link
  • •Checking what a signed or pre-signed URL actually contains
  • •Debugging why a server receives "+" instead of a space
  • •Turning a query string into JSON for a test fixture

FAQ

Is the URL sent anywhere to be parsed?

No. Parsing uses the URL class built into your browser. Nothing is fetched, not even the URL you paste.

Why did my port disappear from the rebuilt URL?

Port 443 for https and port 80 for http are the defaults, so the normalised URL leaves them out. The request goes to the same place either way.

How are repeated parameters converted to JSON?

A key that appears once becomes a string; a key that appears more than once becomes an array of its values, in order.

Does it handle internationalised domain names?

Yes. A host with non-ASCII characters is converted to its punycode form (xn--…), which is what browsers actually send in the request.

Related tools