Why is my URL with a port shown without it?

Because the port is the default for the scheme. The URL standard drops :443 on https and :80 on http, since they add nothing. Non-default ports are always shown.

What happens to repeated query parameters?

Every occurrence is listed. ?id=1&id=2 is valid, and servers disagree about what it means — Express gives you an array, PHP takes the last value, and some frameworks take the first. Knowing there are two is the point.

What is a Punycode hostname?

A hostname written in a non-ASCII script, encoded into ASCII starting with xn--. It is how internationalised domains work, and also how lookalike domains work: some Cyrillic letters are visually identical to Latin ones, so a domain can render exactly like a familiar name and be a different site.

Is the URL sent anywhere?

No. Parsing happens entirely in your browser. URLs frequently contain session tokens and reset links, so nothing here is transmitted or logged.

Encoding & Conversion

URL Parser and Query String Inspector

Paste a URL to see every component and each query parameter decoded. Parsing uses the same URL engine your browser does, so the result matches what the browser will actually do.

URL1 line

Components

Scheme

https

Host

devkithub.tech

Portdefault for the scheme

—

Origin

https://devkithub.tech

Path1 segments

/tools

Query

?category=encoding&sort=name

Fragment

#results

Normalised

https://devkithub.tech/tools?category=encoding&sort=name#results

Query parameters — decoded (2)

How it works

Parsing uses the WHATWG URL engine that both browsers and Node already ship, rather than a regular expression. A URL pattern is the classic example of a problem that looks like pattern matching and is not: the standard is a state machine with rules for percent-encoding, internationalised hostnames, default ports and path normalisation. A hand-written pattern gets a different answer from the browser exactly where it matters, and that gap is how a URL allowlist ends up disagreeing with the code that later fetches the URL — a real and well-exploited class of bug.

What comes back is normalised, which is worth noticing. The host is lowercased, a default port is dropped because https://example.com:443 and https://example.com are the same origin, and a path containing ../ is resolved. The query string is decoded into pairs with every occurrence of a repeated key preserved, because ?id=1&id=2 is legal and different frameworks disagree about which value wins — some take the first, some the last, some build an array.

Three things are flagged rather than reported neutrally. Credentials in a URL, because they end up in browser history, server access logs and Referer headers. An http scheme, because everything after the host travels in the clear. And a hostname that converted to Punycode, meaning it was written in a non-ASCII script — the mechanism behind domains that render identically to a familiar name.

Common problems

Every example below is run against this tool in our test suite, so what it says here is what the tool actually does.

That is not a valid URL.

example.com/path

Why:: No scheme. A URL is not the same thing as a hostname, and the parser has no basis for guessing whether you meant http or https.
Fix:: Add the scheme: https://example.com/path.

A query parameter is missing or has the wrong value.

Why:: An unencoded & or = inside a value ends the parameter early. A redirect URL passed as ?next=https://x.com/?a=b splits at the second question mark and the & inside it.
Fix:: Percent-encode any value before putting it in a query string. The whole nested URL becomes one encoded parameter.

The port disappeared from the parsed output.

Why:: A port that is the default for its scheme is dropped by the URL standard, because :443 on https carries no information.
Fix:: Nothing is wrong. The browser does this too, which is why comparing URL strings for equality is unreliable and comparing parsed origins is not.

Frequently asked questions

Why is my URL with a port shown without it?: Because the port is the default for the scheme. The URL standard drops :443 on https and :80 on http, since they add nothing. Non-default ports are always shown.
What happens to repeated query parameters?: Every occurrence is listed. ?id=1&id=2 is valid, and servers disagree about what it means — Express gives you an array, PHP takes the last value, and some frameworks take the first. Knowing there are two is the point.
What is a Punycode hostname?: A hostname written in a non-ASCII script, encoded into ASCII starting with xn--. It is how internationalised domains work, and also how lookalike domains work: some Cyrillic letters are visually identical to Latin ones, so a domain can render exactly like a familiar name and be a different site.
Is the URL sent anywhere?: No. Parsing happens entirely in your browser. URLs frequently contain session tokens and reset links, so nothing here is transmitted or logged.

Last updated 20 September 2026