URL Inspector

Parses a URL into every component — protocol, credentials, hostname, port, path, filename, extension, query parameters, and fragment — and shows decoded, normalized, and punycode/internationalized-domain views side by side. Flags query parameters that are duplicated, empty, unusually long, or use encoding patterns worth a second look (not a verdict — see the note below). Runs entirely in your browser — nothing you paste here is sent anywhere.

A note on the "suspicious encoding" flag

This flags structural patterns that are sometimes associated with filter evasion or copy-paste corruption — a literal %00 (null byte), a percent sign that is itself percent-encoded as %25 followed by what looks like another encoded byte (double-encoding), encoded CR/LF (%0d/%0a), or a value that fails to decode as valid percent-encoding at all. None of these make a URL malicious by themselves — plenty of legitimate systems double-encode data on purpose, and this tool does not, and cannot, classify a URL as malicious. Treat a flag here as "look closer," not a verdict. See the Defang/Refang tool if you need to safely paste a URL into chat/email without it becoming clickable, and the URL Encoder/Decoder for encoding arbitrary text by itself.