Parse precisely · normalize intentionally
A URL can keep its meaning while changing its bytes.
Browsers parse, normalize, encode, and serialize. That is useful—until a cache key, signature, duplicate parameter, or audit log depends on the spelling you started with.
https://User:pa%24%24@例子.test:8443/a%2Fb/c%20d?tag=red+shoes&tag=web#Top%2FSectionhttps://User:pa%24%[email protected]:8443/a%2Fb/c%20d?tag=red+shoes&tag=web#Top%2FSectionHostname normalization is visible. Credentials, query order, and escaped path separators deserve review before reuse.
Run a URL encoding check
Inspect duplicate query keys, encode a literal plus sign, or resolve a relative path against an explicit base. These operations parse text locally; they do not request the destination.
Loading an example replaces the input and options. Expected excerpts below are taken from the actual parser output.
Keep duplicate keys and distinguish plus from space
Inspect · preserve raw input on. Query pairs retain their order; + becomes a space in the parsed query value, while %2B becomes a literal plus.
Input
https://example.test/search?tag=red+shoes&tag=C%2B%2B&empty=#results
Both tag values survive, and empty= stays an empty string. The fragment is listed separately.
01 "tag" = "red shoes" · repeated key 02 "tag" = "C++" · repeated key 03 "empty" = ""
Encode one query value containing C++
Encode · query component. Paste a single value, not an entire URL. This operation uses encodeURIComponent, so a space becomes %20.
Input
C++ & tea
The two plus signs become %2B%2B, the ampersand becomes %26, and spaces become %20.
C%2B%2B%20%26%20tea
Resolve a parent path against a document directory
Resolve · base URL https://example.test/docs/guide/. The trailing slash makes guide a directory.
Input
../assets/icon.svg?size=2#preview
The parent path removes guide/, retains docs/, and preserves the query and fragment.
https://example.test/docs/assets/icon.svg?size=2#preview
URL anatomy rail
Each delimiter changes the parser state.
https:Security and default-port context
User:••••@Frequently logged or leaked
xn--fsqu00a.testIDN serializes as ASCII
8443Non-default origin member
/a%2Fb/c%20d%2F stays inside a segment
?tag=…&tag=…Ordered key/value pairs
#Top%2FSectionClient-side; not sent in HTTP requests
Query as ordered multimap
Duplicate keys are first-class data.
Object conversion would overwrite tag=red shoes with tag=web. URLSearchParams keeps both pairs in order.
tagred shoesplus decoded as a spacetagwebsame key, second valueempty∅empty valueflag∅key-only spelling normalizesnext/billing?step=2nested URL valueEncoding courtroom
The same glyph can carry different protocol meaning.
red shoesred%20shoesred+shoes in form-style query data
C++C%2B%2BA raw + may decode as space
a/ba%2FbEscaped slash stays inside one segment
例子.testxn--fsqu00a.testIDNA hostname serialization
50%50%25Double encoding would create %2525
Secret-bearing URL triage
Readable does not mean safe to log.
Credentials
HIGHStrip userinfo before sharing or logging.
Access token query
HIGHPrefer headers; query strings spread through logs and history.
Signed parameters
BYTE-SENSITIVENormalization or reordering can invalidate a signature.
Fragment data
CLIENT-SIDENot sent in HTTP, but can still leak through copied links and scripts.
Rebuild diff
Inspect the bytes created by one logical edit.
Only the final byte changed here. Re-run the comparison after sorting, decoding, IDN normalization, or component edits.
?tag=red+shoes&tag=web&next=%2Fbilling%3Fstep%3D2?tag=red+shoes&tag=web&next=%2Fbilling%3Fstep%3D3Continue debugging the request
Decode a test token separately and distinguish readable claims from verified identity.
Use character comparison to spot escaping or normalization changes in a byte-sensitive URL.
Keep URL and text tools together in the local developer toolbox.