URL Parser / Query String Splitter

URLs Explained

URI, URL and URN

A URI (Uniform Resource Identifier) is a string of characters that identifies a resource. It is the umbrella term, defined by RFC 3986. A URL (Uniform Resource Locator) is a URI that also tells you where the resource is and how to fetch it: https://www.example.com/index.html names a document and says "get it over HTTPS from that host". A URN (Uniform Resource Name) is a URI that gives a resource a persistent, location-independent name, such as urn:isbn:0451450523 for a book, without saying where to find a copy. Every URL and every URN is a URI, but the terms are not interchangeable.

Syntax of a URI

In its most general form a URI is scheme:scheme-specific-part?query#fragment. The scheme decides how the rest is interpreted. Some examples taken from the RFCs:

Syntax of a URL

Hierarchical URLs (those whose scheme-specific part starts with //) follow this structure:

scheme://username:password@host:port/path/file-name.suffix?query-string#hash
  └─┬─┘   └──────┬────────┘ └─┬┘ └┬┘ └──────────┬──────────┘ └────┬─────┘ └─┬┘
 scheme       userinfo      host  port          path            query   fragment
         └────────────── authority ──────────────┘
                                                └──────────── resource ────────────┘

Examples: https://www.example.com/products/list.html?category=shoes&page=2#top, ftp://[email protected]:2121/pub/readme.txt, file:///C:/Users/tom/report.pdf, ws://localhost:3000/socket.

Syntax of a URN

A URN is urn:<namespace identifier>:<namespace-specific string>. The namespace identifier (NID) is registered with IANA and defines the meaning of what follows:

• urn:isbn:0451450523 — a book, by ISBN.
• urn:ietf:rfc:2648 — an IETF RFC.
• urn:uuid:6e8bc430-9c3a-11d9-9669-0800200c9a66 — a universally unique identifier.
• urn:oasis:names:specification:docbook:dtd:xml:4.1.2 — an OASIS specification.

A URN never changes even when the resource moves, which is why standards bodies, libraries and XML namespaces like them. Resolving a URN to an actual location requires a separate lookup service.

The userinfo, and why passwords in URLs are dangerous

The username:password@ part was designed for FTP and early HTTP authentication. It is still parsed by every client, but embedding credentials in a URL is a bad idea: the URL ends up in browser history, bookmarks, server and proxy logs, the Referer header sent to other sites, screenshots and chat messages, and it is trivially readable by anyone looking at the address bar. Modern browsers strip or hide the userinfo, and RFC 3986 explicitly deprecates the password form. Use proper authentication (headers, tokens, cookies) instead, and if you find a URL with credentials in a log, treat those credentials as compromised.

The query string

The query string carries parameters to the resource. By convention (not by RFC, which only defines it as opaque text) it is a list of key=value pairs separated by &: ?p1=v1&p2=a%20b&p2=c. A key may appear several times, which most frameworks turn into an array, and a key may have no value at all (?debug). Characters that are not allowed literally are percent-encoded (%20 for a space, %26 for an ampersand, %3D for an equal sign) and, in the application/x-www-form-urlencoded format used by HTML forms, a space may also be written as +. This tool shows both the raw and the decoded value of each parameter; use the URL encoder to encode values yourself.

The fragment

The part after # is the fragment (or "hash"). It refers to a secondary resource inside the primary one: an element with a matching id on an HTML page, a text fragment (#:~:text=…), a page number in a PDF viewer, a time offset in a media file. Because it is only meaningful to the client, browsers never send it to the server and changing it does not reload the page, which is what client-side routers rely on.

Common schemes and default ports