Take a link apart, fix it, and put it back together.
Paste any URL to see every part labelled and the query decoded into a table you can edit. Spaces, accents and symbols are encoded correctly as you type, and tracking tags can be stripped in one click.
A URL can only contain a small set of plain characters. Everything else is converted to UTF-8 bytes and written as % plus two hex digits. Type anything and see each character's journey; characters that would break the URL are highlighted.
Each one looks fine to a person and wrong to a browser. Load any of them into the inspector above to see exactly where it goes wrong.
https://example.com/my file.pdfEmail and chat apps end the link at the space, so the click goes to /my.https://example.com/my%20file.pdfuploadInspect ithttps://example.com/?q=salt&pepperThe & starts a new parameter, so the search is for “salt” and there’s a stray “pepper”.https://example.com/?q=salt%26pepperuploadInspect ithttps://example.com/?city=S%25C3%25A3o%20PauloEncoded twice, so % became %25. The site receives “S%C3%A3o Paulo” as text.https://example.com/?city=S%C3%A3o%20PaulouploadInspect ithttps://example.com/?tag=#designEverything after # is treated as a page anchor and never sent, so tag is empty.https://example.com/?tag=%23designuploadInspect itRFC 3986 is the internet standard most servers, proxies and libraries follow. Browsers follow the WHATWG URL Standard, which also repairs sloppy links: backslashes, stray tabs, odd IP address forms. The left column below uses the RFC's own regular expression; the right one is your browser's real new URL(). When the two disagree on the host, a link checker and a browser can end up on different servers, which is how several real attacks worked.
There's no single “URL encoding”. Each part of a URL has its own set of characters that must be escaped, and JavaScript's functions each pick a different set. Your browser just ran every printable ASCII character through all eight. Click a row to see its grid.
The URL Standard treats six schemes as “special”: they get a lowercased host, backslash repair, dot-segment cleanup and dropped default ports. Every other scheme keeps its host exactly as written. The last three columns were checked in your browser.
No standard sets a maximum. The practical limit is the smallest one along the way, so links meant to be shared should stay under about 2,000 characters.
Developer tools people use alongside this one.