本文へスキップ
DevTools / URL パーサー

URL パーサー

A URL looks like a single string and is actually eight components with separate rules, which is why bugs cluster around them: a query parameter that contains an ampersand, a fragment that the server never sees, a port that disappears when it matches the scheme default. This tool decomposes a URL into its parts, presents the query string as an editable table with duplicate keys flagged, offers percent-decoding so the readable form is visible, and rebuilds the URL from your edits so you can paste the corrected version straight back into a config or a browser.

すべてブラウザ内で実行 — 何もアップロードされません。

Nothing is requested — the string is parsed locally by the browser’s own URL parser.

Protocolhttps
Usernameada
Passwordlovelace
Hostapi.example.co.uk
Port8443
Originhttps://api.example.co.uk:8443
Path/v2/search/items
Queryq=uuid+generator&tags=dev,web&tags=offline&page=2&debug
Fragmentresults
Query parameters (5)
KeyValue
quuid generator
⧉tagsdev,web
⧉tagsoffline
page2
debug—

Repeated keys: tags

仕組み

A URL is parsed against a formal grammar, and the components are hierarchical. The scheme determines how the rest is interpreted. The authority contains an optional userinfo, a host and an optional port. The path is a sequence of segments, and its interpretation depends on the scheme: for http and https it maps to a filesystem-like hierarchy, but for mailto or data it means something else entirely. The query begins after the first question mark, and the fragment after the first hash — and the fragment is never sent to the server, which is the root of an entire class of bug where an SPA route parameter turns out to be invisible to the backend.

Query strings have their own structure that the URL grammar does not describe. The convention is key=value pairs separated by ampersands, but nothing in the specification requires it, and the same key may legitimately appear more than once. Languages differ on how they expose that: PHP takes the last occurrence, Go's url.Values gives you the whole slice, and many frameworks give you an array. This tool keeps every pair as a separate row and flags a repeated key rather than silently overwriting, because the value your server actually reads depends on a language-specific decision you should be aware of.

Percent-decoding is applied for display but never lost. A parameter value of a%20b and a+b are the same value in a form-encoded context and different values in a path, so the decoded column shows the readable text while the encoded form remains what is used to rebuild the URL. This is what makes a nested URL in a redirect parameter comprehensible: the encoded value contains its own question marks and ampersands, all of them escaped, and decoding once exposes the real structure without ambiguity.

Rebuilding applies the same rules in reverse and normalises as a side effect. A default port is dropped, the host is lowercased, the path is resolved against any base you supply for relative input, and empty parameters are preserved rather than discarded. The result is a URL that is byte-identical in meaning to the input while being canonical in form, which is what you want if the URL is going to be compared, cached or signed — signature schemes hash the exact string, so a normalised URL that differs from the original by one character will fail verification.

主な利用シーン

  • Break down a long tracking URL and find the real destination hidden in a redirect parameter.
  • Edit a query string to change a filter or a page number without hand-encoding the result.
  • Find out why a parameter your frontend set is not reaching the backend — usually a fragment or an unencoded ampersand.
  • Separate a URL into host and path to build a firewall rule or a CORS configuration.
  • Resolve a relative URL against a base to see the absolute form a browser would request.
  • Check whether a query string has a duplicated key that different frameworks would resolve differently.

最終更新: 2026-10-14 — 本文は英語で表示されます（UI は翻訳済み）。

よくある質問

Why is my parameter missing on the server?

Three causes cover almost every case. The value is after a hash, and the fragment is never transmitted to the server. The value contains an unescaped ampersand, so the parser treats the rest as a new parameter. Or the value contains an unescaped equals sign, so the split happens in the wrong place. Decoding the URL and looking at the raw query string is the fastest way to tell which: if the intended value is not in the parsed table at all, it is one of these structural problems rather than a server bug.

What happens when a key appears twice?

It depends entirely on the language reading it. PHP and many frameworks keep the last value, some keep the first, Go exposes all of them as a slice, and Ruby's Rack raises or gives an array depending on configuration. This is a genuine source of security bugs: a validation layer that reads the first value of a parameter and a business layer that reads the last can be made to disagree, which is the basis of HTTP parameter pollution. The table flags duplicates so the ambiguity is visible.

Is the fragment really not sent to the server?

Correct, and it is the most commonly misunderstood part of a URL. The fragment is stripped by the browser before the request is made and is never part of the HTTP request line, so server-side code cannot see it. It is used by browsers for scrolling to an anchor and by single-page applications for client-side routing, which is why a route that works in the browser can return a different page when the same URL is fetched by a server or a crawler.

Does a URL contain credentials?

It can, in the userinfo component before the host — https://user:password@example.com/ is valid. Treat any URL containing an at sign before the first slash as carrying a credential, and never log, share or paste such a URL into a third-party service. This tool runs entirely in your browser and transmits nothing, but a signed URL with an access token in its query string is a bearer credential regardless of which tool you inspect it with.

関連ツール