URL Parser — Break a URL into Scheme, Host, Path & Query
Paste any URL and see it decomposed: scheme, host, port, path, every query parameter as its own row, and the fragment — including percent-decoded values.
Last reviewed 2026-10-19. Rates change — verify against the official sources linked below before relying on these figures.
What this is based on
- Parsing follows the WHATWG URL standard (the browser's own URL rules) — scheme-relative and unusual-but-legal forms are accepted.
- Query parameters are shown percent-decoded; '+' decodes to space in query strings.
- A bare host (example.com/path) is parsed as https:// for convenience — prepend a scheme to override.
- Everything runs locally in your browser — pasted content is never uploaded, logged or stored.
Anatomy of a URL
scheme://host:port/path?query#fragment — each part has its own encoding rules. The query string is the interesting half for debugging: order doesn't matter, keys can repeat (?tag=a&tag=b is legal and means two values), and anything user-controlled there should be treated as untrusted input.
The port is optional and defaults to the scheme's well-known port (443 for https, 80 for http) — seeing :443 explicitly is identical to leaving it out.
Where URLs bite in practice
Duplicate parameters and trailing-slash differences are the two classic cache- and SEO-splitters: /a and /a/ are different URLs, and ?utm_source=x&utm_source=y is valid but ambiguous to naive parsers.
Percent-encoding is literal, not semantic: %2F inside a path segment is a slash inside a name, not a directory boundary — which is exactly the discrepancy path-traversal bugs exploit.
Frequently asked questions
- What are the parts of a URL?
- Scheme (https), host (example.com), optional port, path (/a/b), query string (?a=1&b=2) and fragment (#id — never sent to the server).
- Can a URL have the same query parameter twice?
- Yes — ?tag=a&tag=b is valid; each entry is listed here as its own row, which is how servers see it.
- Is the fragment (#hash) sent to the server?
- No — fragments stay in the browser, which is why tokens in #access_token URLs don't leak into server logs.
- Why does my URL have %20 everywhere?
- Percent-encoding for characters that aren't URL-legal. %20 (or +) is a space, %26 is &, %3D is =.
Related calculators
Percent-encode or decode strings, and break any URL into protocol, host, path, query params and fragment — decoded params listed cleanly.
Paste HTTP response headers and instantly see which security headers are missing — HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy — plus cookie flag and Server version checks.
Paste your API's CORS response headers and detect dangerous setups: wildcard origins with credentials, null-origin acceptance, reflected origins and missing Vary: Origin.