RunLocalTools

URL Parser & Builder — Split, Decode, Edit and Compare URLs Online

Free URL parser and builder that runs in your browser. Split any URL into parts, decode parameters, flag phishing tricks, edit, normalize, compare and bulk-process links. Nothing is uploaded.

What it does

Paste a URL and get every part laid out: scheme, username, host, subdomain, registrable domain, public suffix, port, path segments, query parameters and fragment. Each query value is decoded, and values that hide something (a nested URL, a JWT, Base64 JSON, a timestamp, a UUID) are labeled and expanded.

The same page also works as a builder: edit any component or parameter and the URL rebuilds live. It also compares two URLs, fills a URL template from a spreadsheet of values, and analyzes thousands of URLs at once into a sortable table you can export.

How it works

Parsing uses your browser’s own WHATWG URL parser, so the result matches what Chrome, Firefox and Safari actually do. On top of that, the tool also reads the text exactly as you typed it, which is how it can show “as typed” next to “normalized” and catch things the browser quietly rewrites: IP addresses written as 2130706433 or 0x7f.1, %2e%2e path traversal, double-encoded %252f, backslashes treated as slashes, and stray whitespace.

  • Domain split: the registrable domain and public suffix come from a built-in suffix list (including multi-part suffixes like co.uk), so blog.shop.example.co.uk splits correctly into subdomain blog.shop, domain example.co.uk.
  • Internationalized domains: xn-- labels are decoded to Unicode with a built-in punycode decoder, and mixed-script hosts (Latin plus Cyrillic, for example) are flagged as possible lookalike domains.
  • Value decoding: parameters are decoded as query strings (+ means space), then inspected for nested URLs, JWTs (header and payload decoded, signature not verified), Base64 JSON, epoch timestamps and UUIDs.
  • Encoding when building: choose strict RFC 3986, encodeURIComponent style or minimal WHATWG encoding, %20 or + for spaces, and percent-encoded or readable Unicode.
  • Normalizing: each rule (default ports, dot segments, empty ?/#, parameter order, www., trailing slash and more) is a checkbox, with a before/after preview listing exactly what changed.

How to use it

  1. Paste a URL on the Parse tab (or press Sample). Read the warnings at the top, then the components, path segments, parameters and fragment.
  2. Turn on Mask secrets before taking a screenshot or sharing a result. Token, key, signature and password values become REDACTED in the view and in anything you copy or export.
  3. Press Edit in Builder to change the host, path segments or parameters. Toggle a parameter off to leave it out without deleting it, reorder with the arrows, or paste many parameters at once as a query string, key=value lines or JSON.
  4. Open Normalize, tick the rules you want, check the before/after preview and apply it.
  5. Use Template & bulk fill to turn https://example.com/{{section}}/:id?ref={{source}} plus a small CSV of values into a list of finished URLs.
  6. Use Compare to see what differs between two URLs, and whether they point to the same page once ports, parameter order, www., trailing slashes and tracking parameters are ignored.
  7. Use Bulk to paste a list or drop .txt, .csv or .tsv files. Sort, filter by domain, hide duplicates, show only rows with warnings, switch on the parameter matrix, and export CSV or JSON.

Bulk mode and the parameter matrix

Bulk mode reads one URL per line, or a CSV/TSV with a URL column (it finds the column from the header, or by looking for the column that actually contains links). Every URL becomes a row with scheme, host, registrable domain, port, path depth, parameter count and warning flags. The parameter matrix turns each distinct parameter name into its own column, which makes it quick to audit campaign links or spot inconsistent tracking. If your list came from a messy export, tidy it first with the CSV cleaner; if you only need the domains out of a pile of text, the domain extractor is faster.

Percent-encoding and code snippets

Percent-encoding trips people up because the right answer depends on where the text lands: a path segment, a query value and a fragment each have different rules, and a space can be %20 or +. The builder applies the correct set per component. For a one-off conversion of arbitrary text, the text encoder and decoder is the quicker tool. Once your URL is built, Copy as code produces matching snippets for JavaScript, Python, PHP and cURL; if you then want to test the request itself, the cURL converter turns it into fetch code.

What it flags

These are heuristics and can never prove a link is safe.

  • Credentials in the URL, and the https://google.com@evil.example trick where the part before @ is only a username.
  • Raw IP hosts, obfuscated IPs (decimal, hex, octal), and private or local addresses.
  • Mixed-script hostnames and internationalized domains.
  • Redirect-style parameters (next, url, redirect_uri) that point to another site.
  • Encoded traversal (%2e%2e, %2f), double encoding, malformed percent-escapes, and javascript: or active data: URLs.
  • Tokens in the fragment, plain http, very long URLs, and parameters named like secrets.

Supported formats

  • http, https, ftp, ws, wss and file URLs, IPv4 and IPv6 hosts, and ports.
  • Relative URLs, resolved against an optional base URL; protocol-relative (//host/path) and scheme-less input (example.com/page, assumed https).
  • mailto:, tel:, sms:, data:, magnet: and blob: get their own breakdown; other schemes get a generic one.
  • Bulk input: pasted lines, .txt, .csv, .tsv; comma, tab, semicolon or pipe delimited.

Privacy

Everything in this tool is local. Parsing, decoding, the suffix list, the safety checks, comparison, bulk analysis and exports all run inside your browser. It makes no network requests and never fetches, resolves or visits a URL you enter, so it also cannot tell you whether a link is live or where a short link redirects.

By default the tool remembers your working URLs, recent URLs and any files you add, in this browser only (browser storage on your device), so a refresh does not lose your work. URLs can contain tokens or secrets, so there is a Remember my URLs in this browser checkbox: untick it and everything saved is erased and nothing further is stored. Clear saved data wipes it at any time. The tool also needs no external libraries, so there is no first-use download.

Limitations

  • The public-suffix list is a built-in subset, not the full Public Suffix List. Common and country-code suffixes are covered; for an unrecognized suffix the tool says the split is a best guess.
  • JWTs are decoded, not verified. Safety warnings are heuristics.
  • Because it never goes online, it cannot expand short links or check whether a page exists.
  • Bulk tables render 200 rows at a time; exports always include every row. Very large lists (tens of thousands) work but take a few seconds to analyze.

FAQ

Is it safe to paste a URL with a token or password in it? Yes in the sense that nothing leaves your browser. The tool makes no network requests. Because the URL may be saved in your browser for convenience, untick “Remember my URLs in this browser” on a shared computer, and use “Mask secrets” before sharing screenshots.

Why does the tool show “as typed” and “normalized” differently? Browsers rewrite URLs as they parse them: they lowercase the host, drop default ports, resolve .., and convert odd IP spellings like 2130706433 to 127.0.0.1. Showing both lets you see what you wrote and what a browser will actually request.

What is the difference between %20 and + for a space? In a query string, both mean a space; + is the older form-encoding convention. In a path, only %20 is valid, and a literal + there stays a plus. The builder lets you choose for the query and always uses %20 in paths.

How does it tell whether a URL is a phishing link? It doesn’t claim to. It flags patterns commonly used in phishing: a fake domain before an @, lookalike mixed-script hostnames, raw or obfuscated IP addresses, and redirect parameters pointing to another site. A clean result does not mean a link is safe.

What is the registrable domain? It is the part you could register with a domain registrar: the label just before the public suffix, plus the suffix. For shop.example.co.uk it is example.co.uk, and shop is a subdomain.

Can it process a spreadsheet of URLs? Yes. Drop a CSV or TSV on the Bulk tab; it detects the URL column, adds a row per URL and builds the parameter matrix. You can export the results as CSV or JSON, with an option to neutralize spreadsheet formulas.