See exactly what is inside a URL
A web address packs a lot into one line: the protocol, sometimes a username, the host with its subdomain and domain, a port, the path, a query string full of parameters, and a fragment that jumps to part of the page. The URL Parser pulls all of those apart and lays them out in a table, so a long tracking-laden link becomes readable at a glance.
It is useful far beyond debugging. Marketers check which utm_ parameters a campaign link carries, support teams read the page and filters a customer was looking at, developers verify how a form encoded its values, and anyone can strip the tracking junk from a link before sharing it. Edit any parameter in the table and the rebuilt URL updates instantly, correctly encoded.
Parsing uses your browser’s own URL engine (the WHATWG URL standard), so the result matches what Chrome, Firefox and Safari actually do. Nothing you paste is sent anywhere.
How to use the URL Parser
- Paste a link into the box. If it has no
https://, the parser assumes https. - Read the components table: protocol, subdomain, domain, top-level domain, port, path, query string, fragment and origin.
- Review the query parameters. Untick “Show decoded values” to see the raw encoded form (
%20,+). - Edit a name or value, add a parameter, or press “Remove tracking” to drop
utm_*,fbclid,gclidand similar. - Copy the rebuilt URL, or feed it back in with “Use rebuilt URL as input” to parse it again.
URL Parser features
Standards-based parsing
Built on the browser’s URL implementation, so edge cases (IPv6 hosts, IDN domains, unusual ports) resolve the way real browsers resolve them.
Domain split
Separates subdomain, registrable domain and TLD, including multi-part suffixes such as .co.uk, .co.in, .com.au and hosting suffixes like .github.io.
Editable query table
Change, add or remove parameters and watch the URL rebuild live with proper percent-encoding.
One-click tracking removal
Strips utm_source/medium/campaign/term/content, fbclid, gclid, msclkid, Mailchimp and HubSpot IDs, Instagram share IDs and more.
Default ports and hidden passwords
Shows the implied port (443 for https, 80 for http) and masks any password embedded in the URL so it is never displayed in full.
Private
Runs entirely in your browser — paste internal links or links with tokens without them leaving your device.
Anatomy of a URL
Take https://shop.example.co.uk:8443/products/shoes?color=red&size=42#reviews. Each piece has a job:
| Part | Example | What it does |
|---|---|---|
| Scheme / protocol | https | How to talk to the server. https is encrypted; http is not. |
| Subdomain | shop | A host within the domain — often www, blog, api, m or a region. |
| Domain | example.co.uk | The registrable name you own or rent. |
| Top-level domain | co.uk | The suffix managed by a registry. Some, like co.uk and com.au, have two labels. |
| Port | 8443 | Which door on the server. Omitted when it is the default (443 for https, 80 for http). |
| Path | /products/shoes | Which resource on the site, like a folder path. |
| Query string | ?color=red&size=42 | Name=value pairs separated by &, usually filters, search terms or tracking. |
| Fragment | #reviews | A position inside the page. Never sent to the server. |
Why query strings look “encoded”
Only a limited set of characters may appear literally in a URL. Spaces, non-English letters and symbols such as &, =, # and ? inside a value have to be written as percent-escapes: a space becomes %20 (or + in form submissions), & becomes %26 and so on. The parser shows decoded, human-readable values by default and re-encodes anything you edit, so a value like red & blue is safely written as red%20%26%20blue rather than being split into two parameters.
Repeated names are allowed — ?tag=a&tag=b is two parameters — and a name with no = is a valid flag. Both are preserved as-is.
Reading tracking parameters
Links from email, ads and social apps often carry parameters that identify the campaign or click. They do not change the page you see, so they are safe to remove before sharing a link.
- utm_source, utm_medium, utm_campaign, utm_term, utm_content — Google Analytics campaign tags. Build your own with the UTM Builder.
- gclid / gclsrc / dclid — Google Ads and Display click IDs; msclkid — Microsoft Ads; fbclid — Facebook/Instagram.
- mc_cid / mc_eid — Mailchimp campaign and subscriber IDs; _hsenc / _hsmi — HubSpot; igshid — Instagram share ID; si — Spotify/YouTube share IDs.
- Session tokens or signed URLs (
token=,sig=,X-Amz-Signature=) are not tracking — removing them breaks the link. The tool leaves them alone.
Related tasks
Need only the domain names out of a block of text? Use the URL Extractor. To encode or decode a single value, the URL Encoder handles both forms. To see which server a domain points to, try the DNS Lookup.
URL Parser FAQ
Is the URL I paste sent to a server?
No. Parsing happens in your browser with the built-in URL engine. Links containing tokens, internal hostnames or personal data stay on your device.
Why does the parser show a port when my URL has none?
Every scheme has a default port — 443 for https, 80 for http, 21 for ftp. The tool shows it marked “(default)” so you know which port the browser will actually use.
How does it know that example.co.uk is one domain, not a subdomain?
It keeps a list of common multi-label public suffixes (co.uk, co.in, com.au, co.jp, github.io and others). For very unusual suffixes not on the list, the split may treat the second label as the domain; the host itself is always shown correctly.
What is the difference between the query string and the fragment?
The query string (after ?) is sent to the server and usually changes what the page returns. The fragment (after #) is handled by the browser alone — it scrolls to a section or drives a single-page app — and is never sent to the server.
Can I decode a URL that has been encoded twice?
The table decodes one layer. If a value still shows %25 sequences, it was double-encoded; paste the value into the URL Encoder’s decode mode to peel off another layer.
Why is my password shown as dots?
Credentials in URLs (user:password@host) are rarely a good idea and easy to leak in screenshots, so the parser masks the password while still showing the username and the full rebuilt URL in the output box.