URL parser and decoder
Paste a URL to see every component separated, with query parameters listed and percent-encoding decoded. Useful for the long redirect chains and callback URLs that are unreadable by eye.
Runs in your browser — nothing is uploadedWhat has to be encoded
Reserved characters mean something structural: ? # & = / : @ +. A value
containing any of them has to be percent-encoded or it changes the shape of the URL. + is the
subtle one: in a query string it historically means a space, so an unencoded + in a value
disappears.
The fragment never reaches the server
Everything after # stays in the browser. It is not in the request and not in your
server logs, which is exactly why some OAuth flows use it, and exactly why debugging one from server logs is
impossible.
Double encoding
Encoding an already-encoded value turns %20 into %2520. A value that
arrives with visible %25 sequences has been through one encode too many, usually because a URL was
built by string concatenation and then encoded again as a whole.
Never put secrets in a URL
Query strings land in server logs, proxy logs, browser history and the Referer
header sent to third parties. A token in a URL is a token in half a dozen places you do not control.
Questions
Why did the plus sign in my URL become a space?
In a query string + has historically meant a space. A literal plus must be encoded as %2B.
Why does my parameter contain %2520?
It was percent-encoded twice: %20 became %2520. Usually a URL was assembled from already-encoded parts and then encoded again.
Does the part after # get sent to the server?
No. The fragment is browser-only. It never appears in the request or in server logs.
Is it safe to put a token in a query string?
No. Query strings are recorded in server logs, proxy logs, browser history and the Referer header sent to other sites.