# URL Parser - Split a URL into Protocol, Host, Port, Path, Query and Fragment

Page: https://hirantha.me/tools/url-parser
Part of: Hirantha Sandaruwan Lakshan free tools (https://hirantha.me/tools)
Updated: 2026-10-15

Split any URL into protocol, host, port, path, query parameters and fragment. Decodes percent-encoding, flags tracking parameters and rebuilds the URL.

This is a free tool that runs in the browser: open the page to use it. File tools process files on the visitor's own device; files are never uploaded or stored. No account, sign-up, payment or watermark.

Paste a URL to see it taken apart the way a browser reads it: scheme, user name and password, host, port, path segments, every query parameter in a table, and the fragment, all decoded. International host names show their punycode form, relative links can be resolved against a base, and well-known tracking parameters such as utm_source and fbclid can be removed in one click. Nothing is fetched or opened.

A URL has up to eight parts: scheme://user:password@host:port/path?query#fragment. This tool hands the text to the URL class that your browser provides, which implements the WHATWG URL Standard, so the result matches what a browser does with the same link. Parsing also normalises. The scheme and host are lower-cased, a port equal to the scheme's default is dropped (80 for http, 443 for https, 21 for ftp, 80 for ws and 443 for wss), dot segments such as /a/../b are resolved, and characters that are not allowed are percent-encoded. The Normalised URL box shows that form.

The path is split at each slash and every segment is percent-decoded as UTF-8, so b%20c reads as b c. A segment that contains %2F decodes to something with a slash in it, and the table flags it because that slash is data, not a separator. The query is split at & into parameters in order, and a name that repeats is listed once for each time it appears. In a query + means a space and %XX is a byte, so q=caf%C3%A9+au+lait reads as café au lait. A name such as list[] is shown exactly as written: square brackets mean nothing to the URL standard, they are a convention of frameworks such as PHP and Rails. RFC 3986 says the fragment is separated from the rest of the URI before a request is made and is dealt with by the user agent alone, so a server does not receive it.

A host name written with letters outside ASCII is converted to punycode by the URL parser, so münchen.example becomes xn--mnchen-3ya.example (RFC 3492). The tool decodes any xn-- labels back to Unicode for display. It does not check the result against the full IDNA rules, so treat the Unicode form as a display aid. Look-alike letters from other alphabets can imitate a familiar name, so check any xn-- host you did not type. Addresses written in short forms are normalised as well: http://0x7f.1/ and http://2130706433/ both become 127.0.0.1. RFC 3986 deprecates the user:password form and says that passing authentication information in clear text has proven to be a security risk in almost every case where it has been used. The tool warns when a URL contains them.

A relative reference such as ../images/logo.png or /path?x=1 means nothing alone. Enter a base URL and it is resolved against the base the way a browser resolves a link on a page at that address. A pasted address with no scheme, such as www.example.com/page, is refused by the standard parser. By default the tool reads it as https:// plus the text and says so, and the switch turns that off. A value like localhost:3000/api is a special case, because the standard reads localhost: as a scheme, so the tool adds https:// there too. If a URL is invalid, the tool says why where it can: a space in the host, a port above 65535, an IPv4 address with a part above 255.

Marketing links carry parameters that record where a click came from: the utm_ family from Google Analytics campaign URLs, click IDs such as gclid, fbclid and msclkid, and campaign IDs from email tools. When any are found the tool lists them, and the Remove tracking parameters button writes the URL without them, leaving every other parameter exactly as written. This does not change the page in most cases, but a site can use any parameter name for anything, so check the cleaned link before you share it. The Rebuild form lets you edit the scheme, user, host, port, path, fragment and each parameter and shows the URL that results.

Tracking parameters the tool recognises (any name starting with utm_ also counts):
| Parameter | Added by | What it carries |
| --- | --- | --- |
| utm_source | Google Analytics campaign URLs | The referrer, such as a search engine or a newsletter |
| utm_medium | Google Analytics campaign URLs | The marketing medium, such as cost-per-click, banner or email |
| utm_campaign | Google Analytics campaign URLs | The product, slogan or promo code, such as a seasonal sale |
| utm_term | Google Analytics campaign URLs | The paid keyword |
| utm_content | Google Analytics campaign URLs | Tells apart creatives, such as two links in the same email |
| utm_id | Google Analytics campaign URLs | A campaign ID |
| utm_source_platform | Google Analytics campaign URLs | The platform that directs traffic, such as a buying platform |
| utm_creative_format | Google Analytics campaign URLs | The type of creative, such as display, native, video or search |
| utm_marketing_tactic | Google Analytics campaign URLs | The targeting criteria, such as remarketing or prospecting |
| gclid | Google Ads auto-tagging | The Google click ID, added to the landing page URL of an ad click |
| dclid | Campaign Manager 360 enhanced attribution | A click ID added to the landing page URL |
| gbraid | Google Ads | A click identifier for measuring app conversions from iOS campaigns |
| wbraid | Google Ads | A click identifier for measuring conversions under Apple's tracking rules |
| fbclid | Meta (Facebook and Instagram ads) | The Meta click ID, added when someone clicks an ad |
| msclkid | Microsoft Advertising auto-tagging | A unique Microsoft click ID added to the landing page URL |
| ttclid | TikTok Ads | The TikTok click ID, added to the landing page URL |
| twclid | X (Twitter) Ads | The X click ID, used for conversion tracking |
| mc_cid | Mailchimp campaign links | The Mailchimp ID of the campaign that produced the link |
| mc_eid | Mailchimp campaign links | A Mailchimp ID that identifies the email recipient |

Q: What is the difference between host, hostname and origin?
A: The hostname is the name alone, such as www.example.com. The host is the hostname plus the port when the port is not the default, such as www.example.com:8443. The origin is the scheme, hostname and port together, such as https://www.example.com:8443, and it is what a browser compares for the same-origin policy.

Q: Why was the port removed from my URL?
A: Each special scheme has a default port: 80 for http and ws, 443 for https and wss, and 21 for ftp. The URL Standard stores a port that equals the default as no port at all, so https://example.org:443/ and https://example.org/ are the same URL. The tool notes when it drops a written port.

Q: Is it safe to put a user name and password in a URL?
A: No. RFC 3986 deprecates the user:password form and says that passing authentication information in clear text has proven to be a security risk in almost every case where it has been used. A URL with credentials ends up in browser history, server logs and shared links. Use a header, a token or a login form instead, and treat any password that appeared in a URL as exposed.

Q: What is the difference between + and %20 in a query?
A: In a query string, a + is read as a space, and %20 is also a space. In a path, a + is just a plus sign. The tool decodes the query the way the URL Standard does, so + shows as a space in the decoded column and the As written column shows what is really in the URL.

Q: How are repeated parameters and a[]=1 handled?
A: The tool keeps every parameter in order and marks a name that appears more than once. A name such as a[] or b[c] is shown as written. Turning several values into a list or an object is a convention of the server framework, such as PHP or Rails, not something the URL itself says.

Q: Is removing utm and click ID parameters safe?
A: Usually it does not change what the page shows, because these parameters exist for analytics and advertising. A site can use any parameter name for any purpose, though, so the tool lists exactly what it would remove, and you can check the cleaned URL before you use it. Every other parameter is left exactly as written.

Q: Why does localhost:3000 look odd without http:// in front?
A: Without // after it, the standard reads localhost: as a URL scheme, the way mailto: is one, and 3000 as the path. The tool spots a host and port written without a scheme and, unless you switch the option off, reads it as https://localhost:3000.

Q: Is the fragment sent to the server?
A: No. RFC 3986 section 3.5 says the fragment identifier is separated from the rest of the URI before a request is made and is dealt with by the user agent. A server never sees what comes after the # in a normal request.

Q: Does the tool open or fetch the URL?
A: No. It only reads the text. No request is made, no link is opened and nothing you paste is sent anywhere. That also means it cannot tell you whether the page exists.

Q: Why does the host show xn-- at the start?
A: That is punycode (RFC 3492), the way a name with non-ASCII letters is written with the letters a-z, digits and hyphens that the domain name system uses. xn--mnchen-3ya.example is the name münchen.example. The tool shows both forms.

Sources: URL Standard (WHATWG) (https://url.spec.whatwg.org/); RFC 3986: Uniform Resource Identifier (URI): Generic Syntax (https://www.rfc-editor.org/rfc/rfc3986); RFC 3492: Punycode (https://www.rfc-editor.org/rfc/rfc3492); URL - MDN (https://developer.mozilla.org/en-US/docs/Web/API/URL); Google Analytics Help: URL builders, collect campaign data with custom URLs (https://support.google.com/analytics/answer/10917952); Google Ads Help: Google Click Identifier (GCLID), definition (https://support.google.com/google-ads/answer/9744275); Google Ads Help: Updates to iOS 14 campaign measurement (gbraid and wbraid) (https://support.google.com/google-ads/answer/10417364); Campaign Manager 360 Help: Enhanced attribution (dclid) (https://support.google.com/campaignmanager/answer/9182069); Microsoft Advertising: Auto-tagging of Microsoft Click ID (msclkid) (https://learn.microsoft.com/en-us/advertising/msa-help/hlp_ba_proc_microsoftclickid); TikTok Ads Manager: About TikTok Click ID (ttclid) (https://ads.tiktok.com/resources/help/article/tiktok-click-id); Meta: ClickID and the fbp and fbc parameters (fbclid) (https://developers.facebook.com/documentation/ads-commerce/conversions-api/parameters/fbp-and-fbc); X Ads API: Web conversions (twclid) (https://docs.x.com/x-ads-api/measurement/web-conversions); Mailchimp Developer: E-commerce (mc_cid and mc_eid) (https://mailchimp.com/developer/marketing/concepts/e-commerce)

Related tools:

- [URL encode & decode](https://hirantha.me/tools/url-encoder.md): Percent-encode text for a URL, or decode it back.
- [Base64 encode & decode](https://hirantha.me/tools/base64.md): Convert text to Base64 and back, right in your browser.
- [IPv4 subnet calculator](https://hirantha.me/tools/ip-subnet-calculator.md): Work out network, broadcast, netmask, wildcard, host range and host count from a CIDR or mask. Split a network into subnets or turn an IP range into CIDR blocks.
- [Regex tester](https://hirantha.me/tools/regex-tester.md): Test a regular expression against sample text and see every match.