URL Validator

How URL parsing works

Every URL breaks down into a fixed set of components: a scheme (https:), an optional userinfo and host, an optional port, a path, an optional query string and an optional fragment. This tool parses your input with the browser's own native URL class — the same WHATWG URL Standard implementation every browser uses for every link on the page — instead of a hand-written regex, so the breakdown matches exactly what the browser itself would do with it:

https://[email protected]:8080/search?category=shoes#top
        │        │             │      │        │             │
     scheme   userinfo        host   port     path        fragment

The WHATWG URL Standard is deliberately more forgiving than the older RFC 3986 grammar: it silently strips a default port (:443 on https:), silently removes stray tabs and newlines, and percent-encodes disallowed characters like spaces automatically for "special" schemes (http, https, ws, wss, ftp, file) — but not for others, like mailto: or a custom scheme, which keep an "opaque" path. This tool layers its own checks on top of the parsed result — and re-reads your original pasted text where the parser's own normalization would otherwise hide something worth flagging, like whether a default port was typed explicitly, or the URL contained a literal unencoded space.

Frequently asked questions

What's the difference between this and URL Forge?

URL Forge is an editor: it decodes URLs, lets you edit query parameters in a table, and builds UTM links. URL Validator is a read-only inspector: paste one URL and see exactly how it parses per spec, with problems flagged. Use URL Forge to change a URL; use URL Validator to understand why one doesn't work.

Why does the port field come back empty even though I typed :443?

Because :443 is the default port for https, the WHATWG URL Standard strips it as redundant the moment the URL is parsed. This tool re-checks your original input text to tell you it was there and that it's the scheme's default, instead of just showing a blank port.

Is a punycode or IDN domain automatically dangerous?

No. Punycode (the xn-- prefix) is a legitimate, standard encoding for internationalized domain names with non-ASCII characters. It's flagged only as an informational note, since the same mechanism can be used for lookalike-domain tricks, so it's worth a second look, not a red flag by itself.

Does this tool use a hand-written URL parser?

No. It uses the browser's native URL API, the same WHATWG URL Standard implementation Chrome, Firefox and Safari use for every link on the web, and layers its own extra structural checks and warnings on top of what that API exposes.