A user pastes https://api.example.com?q=John O%27Brien&filter=%3Cscript%3Ealert(1)%3C/script%3E into your form. Your regex rejects it — but for the wrong reason. It’s too long. The <script> tag gets stored anyway, and your security team finds it in a database audit three weeks later.
URLs look simple. They have more edge cases than anyone wants to admit: spaces, Unicode, embedded credentials, ports, fragments, query parameters with special characters, and URLs that are technically valid but security nightmares. Writing the handling code from scratch means writing a lot of it wrong.
These eight free browser tools cover the URL operations developers actually need: encode, decode, shorten, expand, validate, parse, build, and analyze User-Agents.
1. URL Encoder/Decoder
Paste a string and encode it to a URL-safe format. Or paste an encoded string and decode it back. The URL Encoder/Decoder handles the full encodeURIComponent/decodeURIComponent cycle and shows you a size comparison: original length, encoded length, and a byte ratio.
This is the tool you reach for when a URL parameter contains a space and you can’t figure out why your API call is failing.
Best for: Fixing query strings with spaces or special characters. Verifying whether a string is single-encoded or double-encoded. Checking the encoded size of API keys or tokens in URLs.
2. URL Expander
Short URLs are a blind spot in most security audits. You can’t see where they point without clicking, and you can’t click a thousand of them.
The URL Expander takes any shortened URL and returns the full destination. It works with is.gd and v.gd via their APIs, and follows HTTP redirect chains for everything else — showing you the complete hop-by-hop path. It also tells you when a URL wasn’t actually shortened, so you can filter out the noise in a mixed list.
Best for: Security audits. Database migrations involving old shortened links. Automated workflows that need to verify link destinations before following them.
3. URL Parameter Builder
baseUrl + ‘?’ + key1 + ‘=’ + encodeURIComponent(val1) + ‘&’ + encodeURIComponent(key2) + ‘=’ + encodeURIComponent(val2)...
This is not a sentence you want in your codebase. The URL Parameter Builder lets you assemble complex URLs from their natural parts: a base URL, key-value query parameters (one per line), path segments, and a hash fragment.
It handles encoding automatically, preserves parameter order (critical for OAuth and some HMAC-based auth schemes), and can output clean URLs, JSON, component breakdowns, or full debug reports. You can also control encoding behavior: full encoding, partial encoding, or none.
Best for: Building OAuth authorization URLs. Constructing deep links with multiple parameters. Generating complex API request URLs from structured data.
4. URL Parameter Extractor
The inverse of the builder: paste any URL and the URL Parameter Extractor dissects it into structured components. It pulls out query parameters (with or without URL decoding), hash fragments, path segments, and URL metadata including subdomain detection and protocol.
It also detects URL type — YouTube, GitHub, Facebook, generic — and flags common patterns like pagination (page, offset), search (q, search), sorting, and filtering parameters. Output formats: JSON, HTML table, summary report, or CSV.
Best for: Reverse-engineering URL structures from analytics exports. Auditing query parameters in API documentation. Converting URL dumps into structured spreadsheet data.
5. URL Shortener
The URL Shortener uses is.gd and v.gd — two real shortening services with no rate limits and no account requirements. Paste a long URL, pick a service, get a short link. Both services have been running for over a decade.
Best for: Creating short links for documentation. Shortening URLs for SMS or email where character count matters. Generating shareable links without signing up for a Bitly account.
6. URL Validator
A malformed URL in a form can fail silently. A http:// link in a form that should be https:// can trigger browser mixed-content warnings in production. A URL containing <script> might indicate an injection attempt your sanitization layer missed.
The URL Validator checks both format correctness and security. It parses the full URL anatomy and runs a security analysis: HTTPS vs. HTTP, suspicious patterns (<script>, javascript:, data:, vbscript:, inline event handlers), IP address usage instead of a domain, excessive length, and excessive subdomain depth. Returns a security score out of 100.
Best for: Validating user-submitted URLs before storing. Pre-flight checks on URL form fields. Security audits of existing forms.
7. Batch URL Validator
One URL is easy. Twenty are tedious. A hundred are a script.
The Batch URL Validator accepts URLs separated by newlines, commas, semicolons, spaces, or any custom delimiter, and returns a per-URL breakdown: validity status, protocol, hostname, port, path, query, fragment, and security score. The summary shows total valid/invalid counts, average security score, and specific issues across the batch.
It flags suspicious TLDs — .tk, .ml, .ga, .cf, .gq — common in throwaway phishing domains, and highlights every URL still using HTTP.
Best for: Auditing URL lists from spreadsheets or database exports. Bulk validation of bookmark collections. Preprocessing URL lists before importing them into a link management tool.
8. User-Agent Parser
Every HTTP request carries a User-Agent string. Most developers ignore it until something breaks: a feature works on Chrome but not Safari, an API returns different data for mobile vs. desktop, or you need device categories for an analytics dashboard.
The User-Agent Parser takes any User-Agent string and returns structured data: browser name and version, operating system, device type (mobile/tablet/desktop), rendering engine, and bot detection. It distinguishes bots from real browsers, flags mobile vs. desktop vs. tablet, and outputs results as an HTML table for easy reporting.
Best for: Debugging device-specific rendering issues. Analyzing server logs for visitor demographics. Filtering bot traffic from analytics. Building device-aware feature flags.
The next time you catch yourself writing a one-off script to validate or encode a URL, open one of these instead. Your regex will appreciate the retirement, and your security team will never have to find a <script> tag in your database.
