// TOOLS

Security Tools

🔗 URL · Encode, Decode & X-ray

Encode and decode (peeling multiple layers), break a URL apart into host, path and parameters —each decoded— and X-ray it for deception: a phishing verdict flagging the @ credentials trick, brand-imitating subdomains, Punycode/homographs, risky TLDs, shorteners, open redirects and tracking.

Frequently asked questions

What does the URL analyzer do?

It breaks the URL into scheme, host, port, path and parameters (each decoded), detects hidden base64 in the parameters and warns about plain HTTP, Punycode (homograph attacks), embedded credentials and double encoding.

Does it peel multiple encoding layers?

Yes, the decoder peels nested encodings (up to 6 layers) until it reaches the readable text.

Difference between encoding a component and a full URL?

"Component" encodes all reserved characters (for a parameter value); "full URL" preserves the separators (:/?&) so the URL is not broken.