URL byte inspector
When a URL looks correct and still 400s, the cause is usually something you cannot see: a non-breaking space pasted from a document, a zero-width character from a CMS, a smart quote, a trailing carriage return. This tool lays the URL out one character per row with its codepoint, its UTF-8 bytes and its percent-encoding, so the culprit stops hiding.
Summary
Characters
How to use
- Paste the URL. The tables fill in as you type; newlines in the paste are dropped so a wrapped URL still works.
- Read the Summary first — character count, UTF-8 byte count, and counts of non-ASCII, control and must-escape characters. If control characters are above zero, that alone explains the failure.
- Tick Show only characters that need escaping to cut a long URL down to just the suspicious rows.
- In the Characters table, spaces render as
␣and control characters render by name (CR,LF,TAB), so nothing is invisible. - Copy report gives you the whole thing as tab-separated text for a ticket or a code review.
The usual suspects
U+00A0 non-breaking space — arrives via Word, Google Docs, Slack and most CMS editors. Looks exactly like a space, is not a space, and percent-encodes to %C2%A0 rather than %20.
U+200B zero-width space and U+FEFF byte-order mark — completely invisible. A BOM at the start of a URL read from a file is a classic: the hostname becomes \u{FEFF}example.com, which resolves to nothing.
U+2018 / U+2019 / U+201C / U+201D smart quotes — an editor auto-replaced your straight quotes. Common in URLs pasted out of a formatted document.
U+000D carriage return at the end — the URL came from a Windows text file, or from a copy that grabbed the line ending. Servers reject it outright, and it is why the "same" URL works when you retype it.
FAQ
Why do some characters show more than two hex bytes?
Because UTF-8 is variable width. ASCII is one byte, most European accents and Cyrillic are two, CJK is three, emoji are four. Each byte gets its own %XX, which is why é becomes %C3%A9 and not %E9.
What does the class column mean?
The RFC 3986 group: unreserved is always safe, gen-delim and sub-delim are structural characters, unsafe must be encoded, control is never legal raw, and non-ASCII needs UTF-8 percent-encoding. The percent-encoding table explains the groups in full.
Is there a length limit?
The table shows the first 600 rows and says how many were left out; the summary counts and the copied report cover the whole URL regardless.
Can it fix the URL for me?
Not automatically — it diagnoses. Once you know which character is wrong, delete it or run the URL through the URL normalizer, which strips control characters and encodes the rest.