Why is the password in the URL not shown?

A `user:password@host` URL is recorded in full by browser history, server logs, and redirect headers, which makes it a security problem in itself. The tool tells you a password is present so you can deal with it, rather than printing the value and creating one more copy.

What if my backend parses it differently?

This uses the browser's WHATWG URL implementation, so it matches actual browser behaviour. Some backend frameworks follow the older RFC 3986 rules, and the two can differ on encoding normalisation, whitespace, and special characters. When diagnosing that kind of bug, look at both parses.

URL TOOLS · NO REQUESTS ARE MADE

URL Parser

Break a URL into scheme, host, port, path, query, and fragment, with risks flagged.

Input

URL

Result

Schemehttps:

Hostnameshop.example.com

Port8443

Path/products/shoes

Querycolour=red&size=42&utm_source=newsletter

Fragmentreviews

Query parameters

Name	Value
`colour`	`red`
`size`	`42`
`utm_source`	`newsletter`

About this tool

Paste a URL and it splits into scheme, user info, host, port, path segments, query parameters, and fragment, with each part colour-coded against the original string. Parsing uses the browser's built-in URL implementation, so it matches what the browser itself will do. Two things get flagged: a password in the URL is reported as present without showing its value, and a scheme such as `javascript:` or `data:` is called out, because those execute or embed rather than locate a resource.

How it works

Paste the URL to inspect.
Read the segmented breakdown and the parameter table.
Check any warnings about dangerous schemes or embedded credentials.

Limits and rules

Uses the browser's own URL parser and never makes a request. A password in the URL is reported as present, never displayed.

Privacy

URLs are parsed inside this browser only. A URL often carries tokens, internal paths, and personal data in its query, so nothing is uploaded, stored, or logged.

Frequently asked questions

Why is the password in the URL not shown?: A `user:password@host` URL is recorded in full by browser history, server logs, and redirect headers, which makes it a security problem in itself. The tool tells you a password is present so you can deal with it, rather than printing the value and creating one more copy.
What if my backend parses it differently?: This uses the browser's WHATWG URL implementation, so it matches actual browser behaviour. Some backend frameworks follow the older RFC 3986 rules, and the two can differ on encoding normalisation, whitespace, and special characters. When diagnosing that kind of bug, look at both parses.

← All URL tools