Free Tool
URL Structure Analyzer
A web address is not one thing — it is a structure: a scheme, a domain, a path, and sometimes a query and a fragment, each with its own meaning. Paste an address below and this tool breaks it into its parts, explains each one in plain English, and flags the tricks phishers hide in the structure. It never visits the address — it only reads the text you paste.
Paste-only — this tool never visits the address. It parses the text you paste, in your browser. Never paste a link here and then visit it: decode it, read it, and decide from the parts. If an address is suspicious, do not open it.
What this tool does
Most people read a web address as a whole, and that is how phishing works: a lookalike domain, a familiar brand name in the path, a long string of characters that hides the real destination. Reading an address by its parts is a different skill, and it is the skill this tool teaches. The scheme — https or http — tells you whether the connection is encrypted. The domain — the part between the slashes — tells you who you are really visiting, and it is the only part that decides the destination. The subdomain, the path, the query and the fragment are details that describe what you are asking for on that domain, and none of them changes where you are going.
This tool parses the address you paste and shows each part separately, with a plain-English note on what it means and what to check. It flags the common tricks: an address that uses http instead of https, a host that is an IP address instead of a name, a domain that uses punycode — the xn-- prefix that hides a non-English lookalike — an at-sign that puts a fake domain before the real one, and a subdomain so long that the real domain is pushed out of sight. Each flag is explained, not just named, so you learn the trick rather than just the warning.
The tool is the companion to the URL encoder and decoder on this site, and to the phishing guides. Encoding and decoding teach you what the characters mean; this analyser teaches you what the structure means. Together they build the habit that stops most phishing: read the address by its parts, and never click one you have not understood.
Try it
Paste a web address (as text, not as a link) and the tool will break it into its parts. Try the example, then paste an address you are unsure about — but do not visit it.
Waiting. Paste a web address and press Analyse this address. This tool never visits the address.
How it works
The tool uses your browser's built-in URL parser, the same parser the browser itself uses when you type an address. Give it a string and it returns the parts: the scheme (the protocol, usually https), the host (the domain, including any subdomains), the port (if one is given), the path (the page or file being asked for), the query (the key=value pairs after the question mark), and the fragment (the part after the hash, which the browser handles locally and never sends to the server). If the string is not a valid address, the parser throws an error, and the tool reports it instead of guessing.
The red-flag checks run on those parts. The scheme is checked first: http means the connection is not encrypted, and on a page that asks for a password or a payment that is a reason to stop. The host is checked for an IP address — a legitimate site almost never asks you to visit it by its numbers — for the xn-- prefix that marks punycode, where a domain uses non-English characters that can look identical to English ones, and for an at-sign in the authority, which means everything before it is a username and the real domain is after it. The host is also checked for depth: more than three or four levels of subdomain can be a way of pushing the real domain out of the reader's view. And the query is checked for a long encoded string, which is not a red flag on its own but is worth reading — because the query is where tracking parameters and redirect destinations hide.
The most important part of the analysis is the one the tool repeats in every result: the domain is the destination. Everything before it is either a scheme or a username; everything after it is a path, a query or a fragment that describes what you want from that domain. A familiar brand name in the path does not mean the brand runs the site, and a long subdomain does not change the domain. Read the domain first, and the rest second.
Limitations
This tool reads the structure of an address; it does not tell you whether the site is safe. A well-formed address can lead to a phishing page, and a strange-looking address can be legitimate — for example, a long query string is normal on a search results page. The flags are warnings to investigate, not verdicts, and the final check is always the same: is the domain the one you intended to visit, and did you reach it through a channel you trust?
- The tool never visits the address. It parses the text you paste, in your browser, and nothing is sent anywhere.
- The parser needs a complete address, including the scheme (https://). A bare domain such as example.com will be reported as invalid — add https:// in front.
- A valid, well-formed address is not a safe address. Structure is one check among several: the sender, the context and the domain together decide.
Examples
Example 1 — a normal address. Paste https://www.example.com/login?next=/account. The parts are: scheme https, host www.example.com, path /login, query next=/account. The domain is example.com, the subdomain is www, and the query says where to go after login. Nothing is hidden, and the structure is exactly what you would expect.
Example 2 — the suspicious example. Press Try a suspicious-looking example to analyse an address with an at-sign, an IP address, and a long subdomain. The tool flags all three, and explains each: the at-sign means the domain before it is a username and the real host is after it; the IP address means there is no domain name at all; and the long subdomain is pushing the real host out of view. Three flags is three reasons to stop.
Example 3 — a familiar brand in the wrong place. An address reads https://login.example.com.evil.example/ — or, in a common variant, https://evil.example/login?site=example.com. In the first, the domain is evil.example, and example.com is a subdomain of it — the brand name is in the wrong part of the address. In the second, the brand name is in the query, where it changes nothing. The domain is the destination, and it is the only part that decides where you are going.
Frequently asked questions
What are the parts of a URL?
The scheme (https), the host (the domain, with any subdomains), the port (usually hidden), the path (the page), the query (key=value pairs after a question mark) and the fragment (after a hash, handled by the browser). The domain is the part that decides where you are going.
Why does the domain matter more than the rest?
Because the domain is the destination. Everything after it — the path, the query, the fragment — describes what you want from that domain, and a familiar brand name in the path does not mean the brand runs the site. Read the domain first.
What is the @ trick in a web address?
An address can contain a username before an @ sign: https://trusted.example@evil.example/ goes to evil.example, not to trusted.example. Everything before the @ is a username; the real domain is after it. It is one of the oldest phishing tricks.
What is punycode, and why is it a red flag?
Punycode (the xn-- prefix) lets a domain use non-English characters. Some of those characters look identical to English letters, so a domain can look like a familiar brand while being a different address entirely. A domain with xn-- in it deserves a second look.
Is an IP address in a link always dangerous?
Not always, but it is a strong warning sign. Legitimate sites almost never ask you to visit them by their IP address. A link whose host is a string of numbers should be treated as suspicious until you have another reason to trust it.