The shape of a URL
The full grammar is scheme://user:password@host:port/path?query#fragment, and most of it is optional. The scheme decides how the rest is interpreted; the host names the server; the port is implied by the scheme unless it is stated, 443 for https and 80 for http. The path addresses something within the server, the query carries key=value pairs joined by &, and the fragment is the only part the browser keeps to itself. This tool uses the browser's own URL parser, so what you see is what your browser would do with the address, including its normalisation: a host is lowercased, a default port is dropped, and dot segments in the path are resolved. Nothing is uploaded and nothing is stored.
The fragment never reaches the server
Everything after # is handled entirely by the browser. It is not in the request line, it is not in the access log, and no amount of server-side code can read it. That is why it works for scroll anchors and for client-side routing, and why it was historically used to pass values a server should not see. It is also why a fragment survives a redirect that drops the query: browsers reattach it to the new URL unless the redirect target has one of its own. If a value you expected is missing on the server, check whether it ended up behind the #.
Decoded values and the plus sign
Query values arrive percent-encoded, so the table shows the decoded form — what the receiving application will actually see. Spaces are the one genuinely ambiguous case: in the URL grammar a space is %20, while in form encoding it is +. This tool treats + in a query value as a space, matching what almost every server framework does, which means a value that contains a real plus sign will read one character short unless it was encoded as %2B. Phone numbers with a country code are where this shows up most often. In the path, a + is always a literal plus and is decoded as one.
Editing without breaking the encoding
Values in the add box are encoded for you, so type them as they should read and let the tool escape them. An existing key is replaced rather than duplicated, which is the behaviour you want when you are stepping a page parameter through a few values. Sorting by name is useful for two things: comparing two URLs that should be equivalent, and normalising cache keys, since ?a=1&b=2 and ?b=2&a=1 are the same request to a server but different strings to a naive cache. Neither of those is something a browser does for you, which is why URLs that differ only in parameter order routinely produce duplicate entries in analytics and duplicate objects in a CDN.
Questions people ask
Does it need the https:// prefix?
It tries without one. If the string does not start with a scheme, the tool retries with https:// prepended, which works for anything that begins with a hostname. It cannot work for a bare path like /catalog/page, because a relative reference has no meaning without a base URL to resolve against, and guessing one would produce a confidently wrong answer.
Why did my URL come back slightly different?
The URL parser normalises as it goes. Hostnames are lowercased and IDN hosts are converted to punycode, a default port is removed, an empty path becomes /, and dot segments are resolved. Those changes are all semantically neutral — the normalised form addresses the same resource — but they will show up in a character-by-character diff, so do not use the rebuilt string to test whether two URLs were byte-identical.
Is it safe to paste a URL with a session token in it?
Nothing is transmitted. The parse runs in JavaScript on the page and nothing is written to storage or sent over the network. The practical caution is the same as anywhere else: the value is rendered on screen in full, so treat it the way you would treat any secret visible in a window you might be sharing.
What if the same parameter appears twice?
The table lists every occurrence and flags the duplicate, because the correct interpretation depends entirely on the server. This is the usual cause of a multi-select form saving only one value: the browser sends every checked box as a repeat of the same key, and a framework that keeps only the last one silently discards the rest.