Free Online URL Tools — Encode, Parse, Build, Validate

80 browser-based URL utilities · updated 31 July 2026

80 free URL tools that run entirely in your browser — encode and decode percent-encoding and Base64URL, parse a URL or ten thousand into a spreadsheet, build URLs, query strings, UTM campaigns, sitemaps, hreflang and signed links, validate encoding and robots.txt rules, extract URLs from HTML and Markdown, generate redirect maps for six servers, read a pasted curl command or a HAR file, and check a link for tracking parameters, leaked credentials or phishing tricks before you click it. Nothing is uploaded — every operation runs locally. No sign-in, no ads, batch mode on nearly every tool. Press / to search them all.

Encoding and decoding URLs

URL encode / decode round-trips strings between human-readable and percent-encoded form — toggle between encodeURI (whole URL, keeps :/?#&= intact) and encodeURIComponent (every reserved char escaped, for parameter values). Base64URL handles RFC 4648 §5 (URL-safe Base64, the kind JWTs use — - instead of +, _ instead of /, no padding). Data URI builder turns images, SVG, and text into inline data: URIs for CSS and HTML embedding. Punycode / IDN converts internationalized domains to xn--… form and flags mixed-script labels. Batch URL encoder processes thousands of URLs at once — paste a list or CSV, get the result back in the same shape.

Double / multi decoder peels a repeatedly encoded URL one pass at a time, so you can see how many layers were applied and copy the one you wanted. HTML entity fixer repairs the & that arrives in links copied out of HTML source. Percent-encoding table is a searchable reference for all 128 ASCII characters with their RFC 3986 class and whether encodeURI and encodeURIComponent escape them. Unicode escapes converts between text and \uXXXX, \u{…}, the legacy %uXXXX form, HTML numeric references and CSS escapes — and decodes all of them at once. Deflate + Base64 codec reads a PlantUML or Kroki diagram URL back to its source, and builds one. Escape for code quotes a URL correctly for twenty languages and formats at once. Byte inspector lays a URL out one character per row with codepoints and UTF-8 bytes, which is how you find the non-breaking space that is breaking it. Legacy charset decoder reads percent-escapes as Shift_JIS, GBK, windows-1251 or Latin-1 and ranks all 25 charsets by how few characters break.

Parsing and inspecting

URL parser breaks any URL into scheme, user, host, port, path segments, decoded query parameters (as an editable table), and fragment, plus the WHATWG-normalized form. Query-string editor gives you a draggable, dedupe-able table for any ?key=value string. JWT decoder decodes the header and payload of a JWT and tells you whether it's expired (no signature verification — that needs the secret). URL diff shows what's different between two URLs piece by piece — green for same, red for different, yellow for one-sided. URL explainer describes a URL in plain English, recognising common tracking parameters and what each platform uses them for.

Batch URL parser explodes a whole list into spreadsheet columns, with one column per query parameter, and exports CSV, TSV or JSON. Query parameter diff compares two URLs parameter by parameter with an explicit verdict per name — the fastest answer to "it works with this URL but not that one". URL length checker measures characters and UTF-8 bytes against ten real limits, from Internet Explorer's 2 083 to nginx's 8 192. Sitemap URL lister turns a pasted sitemap.xml — or a sitemap index — into a table with lastmod, priority and image counts. Path depth analyzer shows a URL list's shape as a depth histogram and a folder tree with counts per branch. URL → breadcrumbs produces the visible trail, accessible HTML and BreadcrumbList JSON-LD from one URL.

Building and generating

URL builder composes URLs via labeled fields with live preview; templates save to LocalStorage. UTM builder handles the full Google Analytics campaign-tag lifecycle with channel presets and a recent-history pane. UTM cleaner strips tracking parameters (UTM, gclid, fbclid, mc_cid, _ga) with a one-click button. Slug generator turns titles into URL-safe slugs with WordPress / Ghost / Hugo / GitHub-anchor presets and Unicode transliteration. QR code from URL outputs SVG and PNG with optional centre logo and error-correction control. mailto / tel / sms builds clickable links for email, phone, SMS, and FaceTime. geo / magnet / crypto URIs generates niche schemes from form fields. Social share links produces share-intent URLs for X, Facebook, LinkedIn, Reddit, WhatsApp, Telegram, Bluesky, and email in one batch. URL → Markdown link converts URLs to Markdown, HTML, BBCode, Slack mrkdwn, or reST.

Query-string builder takes key=value lines or a JSON object and offers the four array notations backends disagree about, plus form and strict RFC 3986 encoding. Bulk UTM builder multiplies landing pages by channels and campaigns to generate every tagged URL at once, with lowercasing and hyphenation applied uniformly. Sitemap generator turns a URL list into a valid sitemap.xml with per-line lastmod and automatic priority by depth — no crawl, no row limit. hreflang generator emits link tags, an HTTP Link header and sitemap markup, and validates the locale codes and the x-default. Pattern expander expands curl-style {a,b} and [1-100] globs into a URL list. Pagination URLs generates page, offset or path-segment ranges and knows that page one should have no parameter. Signed URL builder signs and verifies HMAC-SHA256 URLs with an expiry, using WebCrypto so the secret stays in the tab. srcset builder turns one URL pattern into a complete responsive <img> and <picture>. Batch QR codes renders one code per line with your own filenames and downloads them all as a ZIP.

Validating and checking

URL validator checks one URL or a list against the WHATWG spec — strict or lenient mode, with the exact character position of any error. URL normalizer canonicalises URLs with RFC 3986 §6 plus optional rules — sort params, drop default port, lowercase host, force trailing slash. Redirect URL decoder unwraps Google AMP, Google Search redirects, Facebook l.php, Outlook SafeLinks, YouTube short links, Bitly preview pages, LinkedIn lnkd.in previews, and t.co — all pattern-based, no network call. IDN homograph checker catches phishing domains that mix Cyrillic, Greek, or other lookalike characters with Latin in the same label. Deep-link syntax tester validates iOS Universal Link, Android App Link, and custom-scheme URIs and emits the matching apple-app-site-association / assetlinks.json entries.

Encoding validator finds every escaping fault in one pass — incomplete % escapes, raw spaces and control characters, double encoding, %uXXXX, HTML entities, over-escaped unreserved characters — and offers a repaired version. URL regex tester tests a pattern against a whole list, with ten presets that already work. TLD checker validates domain endings, suggests the intended TLD for typos like .cmo, and flags reserved names such as .local and .internal that will never resolve publicly. robots.txt tester matches a URL list against pasted rules using Google's algorithm — most specific user-agent group, longest rule wins, allow breaks ties. UTM naming linter catches the case drift and unrecognised utm_medium values that split a campaign across three rows in every report. Canonical grouper groups the URLs in a list that collapse to the same page and exports the duplicate-to-canonical pairs.

Extracting and transforming

Extract URLs from text pulls URLs out of any blob — plain text regex, HTML attributes, Markdown link syntax, or auto. Domain / host extractor converts a URL list into unique hostnames or eTLD+1 using the in-browser Public Suffix List. URL sorter / deduper normalizes, sorts, and deduplicates a list with your choice of rules. Favicon URL builder generates the four standard favicon URL patterns (own /favicon.ico, Google S2, DuckDuckGo, Icon Horse) with side-by-side preview.

HTML link audit parses pasted HTML for every href and src with its anchor text, rel and target, and flags empty anchors and target=_blank without rel=noopener. Markdown links converts between inline and reference style, autolinks bare URLs without touching code blocks, and finds references whose definition is missing. URL list diff compares two lists as sets — added, removed, unchanged — which is the first check after any migration. Bulk find and replace rewrites a list with a before/after preview, scoped to the host, path, query or fragment so it cannot touch the rest. Parameter keep / drop applies an allowlist or blocklist of parameter names, with wildcards and presets for tracking, session and display parameters. Relative ↔ absolute resolves references against a base and names the rule that applied. Redirect map generator turns old → new pairs into rules for Apache, nginx, Netlify, Vercel, Cloudflare, Caddy or IIS, and warns about chains and loops before you deploy them.

Previewing and sharing

OG / Twitter Card meta builder generates Open Graph + Twitter Card + Schema.org <meta> tags from a form, with mock previews of how Slack, Discord, X, LinkedIn, Facebook, iMessage, and Telegram will unfurl your URL. URL fingerprint produces a one-page health card with SHA-256, length, char-class histogram, and suspicious-pattern flags — a starting point, not a verdict.

SERP snippet preview measures your title and description in pixels, not characters, and shows where Google cuts them on desktop and mobile. Social card renderer takes pasted meta tags — no fetch, so staging and unpublished pages work — and shows what Slack, X, LinkedIn, Facebook and Discord will make of them, with the mistakes that break unfurls listed. QR code reader decodes a QR image locally and checks the URL inside it before you visit it.

Working with HTTP

curl command parser takes the enormous one-liner that DevTools' “Copy as cURL” produces and reads it as a table — method, host, every query parameter decoded, every header, the body, and what each flag does — with the fetch() equivalent alongside. It parses shell quoting properly and never runs the request. URL → code snippet goes the other way, emitting the same request in fourteen languages with the quoting each one needs. HTTP header parser labels raw request or response headers, breaks Cache-Control, CSP, Permissions-Policy and Link into their individual directives, and checks a response for the five security headers worth having. Cookie parser lays out every attribute of a Cookie or Set-Cookie header and names the rules browsers enforce silently — SameSite=None without Secure, the __Host- prefix requirements, sizes over 4 096 bytes. HAR URL extractor reads a .har file locally into a filterable request table with totals, third-party host counts and the slowest and heaviest requests. Link header builds and parses RFC 8288 headers for preload, preconnect, canonical and pagination.

Security and privacy

These are defensive tools for URLs you own or have been sent. None of them makes a network request. Open-redirect scanner finds the parameters in your own URL inventory that carry a destination, and which of them accept an off-site one — including the scheme-relative and encoded-slash values that defeat naive validation. Obfuscated URL decoder shows the host a browser will really connect to, decoding decimal, octal and hex IP hosts, the @ userinfo trick, backslashes, zero-width characters and Punycode. Typosquat checker generates the lookalike domains worth monitoring for your brand across nine techniques, or scores a list of found domains against it. Mixed-content checker finds http:// subresources on an HTTPS page and says which will be blocked, which are silently upgraded and which produce a warning. URL privacy audit looks for what a URL leaks — email addresses, JWTs, API keys, session ids, coordinates, card-shaped numbers, including inside base64-encoded parameters — because a URL ends up in your logs, your analytics, the Referer header and the user's synced browser history.

What every tool has in common

Everything runs in your browser. The URLs you paste, the files you drop, and the data you build — none of it is transmitted to any server. There is no upload step, no fetch against an arbitrary host (CORS would block that for most useful targets anyway), and no account system. Verify it yourself in the browser's Network tab: after the page loads, paste anything you like — the Network tab stays silent. See the privacy policy for the longer version.

Batch mode by default. Every tool that operates on a single URL also accepts a list. Paste one or many; the same encode / normalize / extract / validate logic runs on each row, with progress for large batches. CSV in, CSV out where it matters.

We don't fetch your URLs. CORS prevents the browser from following arbitrary cross-origin redirects, fetching live Open Graph metadata, or screenshotting third-party pages — so we don't pretend to. For each of those we either pattern-match (the redirect decoder unwraps known wrappers without a network call), produce a mock preview (the OG builder), or give you a one-line curl command to run on your terminal (the deep link tester).

Free to use, with no warranty. Read the terms of use before relying on the output for anything load-bearing. Bug reports and feature requests are always welcome — drop me a line.

— S., [email protected]