Why is a token in a query string a problem?

Because a query string gets written down in more places than a header does. It lands in server and proxy access logs, stays in browser history, and is often picked up by analytics. It can also travel in the Referer header, though far less than it used to: browsers now default to strict-origin-when-cross-origin, which strips the path and query from cross-origin referrers. That default is not guaranteed, and none of the other copies go away, so a credential still belongs in a header or a request body.

Why does a plus sign become a space?

Because in a query string it means one. The application/x-www-form-urlencoded rules used by forms and by most query strings encode a space as +, so a literal plus has to be written %2B. This decodes the same way the browser's own URLSearchParams does, which is what your server will see.

Is ?debug the same as ?debug= ?

Not on the wire. The first carries no equals sign at all; the second carries one with nothing after it. Most server-side parsers flatten both to an empty string, including the browser's own URLSearchParams, which is exactly why this page splits the query string itself instead of asking the platform: a tool that showed you what the parser saw could not show you what was sent. If something in your stack reads the raw query rather than a parsed map, the two are not interchangeable.

Which value wins when a parameter is repeated?

It depends on the server, which is why the tool flags it rather than picking one. PHP keeps the last, Rails keeps the last unless the name ends in [], Express gives you an array, and Go's Query().Get returns the first. Code that relies on any of these is relying on a framework detail.

Does editing a URL here change it anywhere?

No. Removing a parameter, sorting, or adding one only changes what this page shows you and what the rebuilt URL says. Nothing is requested, followed, or sent. The rebuilt URL is text for you to copy, and the page never puts it in its own address bar.

Why does the rebuilt URL keep the original encoding?

Because re-encoding would change parameters you never edited. Percent-encoding has choices in it: which characters to escape, upper or lower case hex, and + or %20 for a space. A tool that decoded everything and encoded it again would hand back a URL in its own dialect rather than yours, and a signed URL would stop matching its signature. Parameters you did not touch are written back from their original text; only ones you add are encoded here.

Can I paste a URL without the https:// prefix?

Yes, when it still looks like a host. If the input has no scheme but starts with something host-shaped, https is assumed for parsing and the result says so. A bare query string, with or without its leading question mark, is also accepted.

HTTP & APIs / LOCAL TOOL

URL & Query String Inspector

Break a URL into its parts and decode every query parameter locally, with credentials in the query string flagged.

Runs locally — input is never uploaded

URLPaste a URL or query string

ResultReady when you are

WHAT IT DOES

Every part of a URL, and every parameter decoded.

Paste a URL and it is split into scheme, host, port, path, query, and fragment, with each path segment and query parameter percent-decoded so you can read the values your server will actually receive. A bare query string works too, with or without its leading question mark. Parsing uses the browser's own URL implementation, so the result matches what fetch, a redirect, or a same-origin check would see rather than an approximation of it. Parameters that look like credentials are flagged, because a query string is the one place a secret should never be.

Why use it?

A long URL can hide repeated parameters, encoded values, or an unexpected destination. Inspect its components before sharing it or constructing a request.

How to use this tool

Paste the complete URL into the input.
Inspect its host, path, query entries, and fragment; the page does not fetch the destination.
Copy the individual values you need. Preserve repeated query parameters when the receiving service expects more than one value.

Details and limitations

Query values are shown percent-decoded, with + read as a space, which is how a form-encoded query string is meant to be read, and the raw text is shown alongside wherever decoding changed it.
A bare flag such as ?debug is distinguished from ?debug=, which carries an equals sign and nothing after it. Most parsers flatten both to an empty string, so the difference is invisible unless something shows you the query string as it was actually sent.
A parameter that appears more than once is listed once per occurrence and flagged, since servers disagree about which one wins.
Analytics and ad-click parameters such as utm_source, fbclid, and gclid are marked as tracking. They identify the visit rather than the resource, so the URL points at the same thing without them.
When a URL carries tracking parameters, one button strips them and copies the cleaned URL. Only tracking is removed: a parameter that merely looks like a credential is left alone, since taking it out would usually break the link.
The total length is reported with the part responsible for it, and called out past 2,000 characters. That is a compatibility heuristic rather than a limit: nothing breaks at 2,001, but below it you can stop thinking about the question.
Parameters can be removed one at a time, stripped of tracking in one go, sorted, or added, and the rebuilt URL follows every edit. Reset restores what you pasted.
A parameter you did not touch is rebuilt from its original text rather than re-encoded, so hello+world stays hello+world instead of becoming hello%20world.
Parameters whose names suggest a credential are marked. A query string may appear in server logs, browser history, analytics, and referrer data depending on the referrer policy. Names are matched as whole words, so monkey is not read as a key.
A parameter carrying another URL, such as redirect_uri or next, is called out, because an unvalidated value there is an open redirect.
The port is shown even when the URL omits it, labelled as implied by the scheme rather than present in the text.
A punycode hostname is flagged as representing an internationalized domain name, since a name that renders as familiar text may not be the domain it appears to be.

WORKED EXAMPLES

Preserve repeated query parameters

Inspect a URL with two tag entries and a percent-encoded search term. It is parsed locally, not opened or fetched.

URL

https://example.com/items?tag=a&tag=b&q=red%20fox#details

Expected result

Host example.com, path /items, two separate tag values a and b, decoded q value red fox, and fragment details. Do not collapse repeated parameters into one value unless the receiving API expects that.

COMMON QUESTIONS

URL Inspector questions

Why is a token in a query string a problem?: Because a query string gets written down in more places than a header does. It lands in server and proxy access logs, stays in browser history, and is often picked up by analytics. It can also travel in the Referer header, though far less than it used to: browsers now default to strict-origin-when-cross-origin, which strips the path and query from cross-origin referrers. That default is not guaranteed, and none of the other copies go away, so a credential still belongs in a header or a request body.
Why does a plus sign become a space?: Because in a query string it means one. The application/x-www-form-urlencoded rules used by forms and by most query strings encode a space as +, so a literal plus has to be written %2B. This decodes the same way the browser's own URLSearchParams does, which is what your server will see.
Is ?debug the same as ?debug= ?: Not on the wire. The first carries no equals sign at all; the second carries one with nothing after it. Most server-side parsers flatten both to an empty string, including the browser's own URLSearchParams, which is exactly why this page splits the query string itself instead of asking the platform: a tool that showed you what the parser saw could not show you what was sent. If something in your stack reads the raw query rather than a parsed map, the two are not interchangeable.
Which value wins when a parameter is repeated?: It depends on the server, which is why the tool flags it rather than picking one. PHP keeps the last, Rails keeps the last unless the name ends in [], Express gives you an array, and Go's Query().Get returns the first. Code that relies on any of these is relying on a framework detail.
Does editing a URL here change it anywhere?: No. Removing a parameter, sorting, or adding one only changes what this page shows you and what the rebuilt URL says. Nothing is requested, followed, or sent. The rebuilt URL is text for you to copy, and the page never puts it in its own address bar.
Why does the rebuilt URL keep the original encoding?: Because re-encoding would change parameters you never edited. Percent-encoding has choices in it: which characters to escape, upper or lower case hex, and + or %20 for a space. A tool that decoded everything and encoded it again would hand back a URL in its own dialect rather than yours, and a signed URL would stop matching its signature. Parameters you did not touch are written back from their original text; only ones you add are encoded here.
Can I paste a URL without the https:// prefix?: Yes, when it still looks like a host. If the input has no scheme but starts with something host-shaped, https is assumed for parsing and the result says so. A bare query string, with or without its leading question mark, is also accepted.