Debug an OAuth callback
Confirm the exact origin, path, and query values returned by an identity provider.
All developer toolsRuns locally in your browser
FREE BROWSER TOOL
URL Inspector
Parse and inspect URLs locally: protocol, origin, hostname, port, path, query parameters, and fragment in one readable view.
Use URL parser now.
Break a URL into every meaningful part. Your result updates in the current tab as you work.
URL Inspector
Break a URL into every meaningful part. Nothing you enter here is uploaded or stored.
Query values are decoded and grouped into a readable object.
URL anatomy
{
"protocol": "https:",
"origin": "https://sovrancode.com",
"hostname": "sovrancode.com",
"port": "default",
"pathname": "/en/courses/html",
"query": {
"level": [
"beginner"
]
},
"hash": "#curriculum",
"requestNote": "Fragment is browser-side and is not sent in an HTTP request."
}WHAT IT DOES
Useful when a small detail is blocking the next step.
A URL carries more than a destination. Its scheme, host, port, path, query parameters, and fragment each influence how browsers and servers behave. URL Inspector parses a complete absolute URL using the browser URL standard and exposes the parts you need to debug a redirect, link, callback, or request.
Review tracking parameters
Inspect decoded query keys and values without manually separating ampersands and percent encoding.
Check deployment links
Compare protocol, port, and host when localhost, preview, and production links behave differently.
WORKED EXAMPLES
See the exact decision the tool can help you make.
These examples are specific to URL parser. Replace their values with your own, then use the result as a clue—not as a substitute for application validation.
Separate origin from route
A callback works locally but fails in production.
INPUT
https://app.example.com:8443/auth/callback?next=%2Faccount#complete
RESULT
origin: https://app.example.com:8443 path: /auth/callback query next: /account fragment: complete
The port belongs to the origin. The fragment is not delivered to the server, so it cannot drive a server redirect decision.
Spot repeated query keys
A filter URL needs more than one tag.
INPUT
https://example.com/search?tag=sql&tag=security&q=foreign+key
RESULT
tag: sql tag: security q: foreign key
Repeated keys are valid. Your server must choose whether it expects an array, the first value, or the last value.
HOW TO USE IT
Three deliberate steps.
Use the result to make a decision in your code or content, not merely to produce another value to copy.
- 01
Paste an absolute URL
Include http:// or https:// so the browser can distinguish a host from a relative path.
- 02
Read origin separately
Origin is protocol, hostname, and port together; it matters for CORS, cookies, and redirect allowlists.
- 03
Review decoded query fields
Check both names and values, especially repeated, blank, or unexpectedly encoded parameters.
A fragment is browser-side
The part after # is normally not sent in an HTTP request. Use it for in-page state or navigation, not for server authorization, secrets, or data your backend must receive.
Do not decide whether a redirect is safe with startsWith or string concatenation. Parse the candidate URL, enforce an expected origin or relative-path policy, and reject anything outside that policy.
const candidate = new URL(next, request.url);
if (candidate.origin !== request.nextUrl.origin) {
throw new Error("Unsafe redirect");
}COMMON PITFALLS
Use the result without creating the next bug.
Each tool is deliberately narrow. These are the mistakes most likely to appear when its output is copied into a real product without checking the surrounding constraint.
Comparing a full URL when the security rule is about origin.
Why it matters: Paths and queries change; a redirect allowlist normally needs a strict scheme, host, and port decision.
Better approach: Parse first, then compare the normalized origin against explicit allowed origins.
Putting access tokens in a query string.
Why it matters: Queries can leak into history, logs, analytics, and shared links.
Better approach: Use secure authorization headers or a carefully designed short-lived callback mechanism.
FAQ
Questions worth answering before you rely on the result.
These tools help with bounded client-side work. Production decisions still need the validation, review, and authorization appropriate to your application.
01Why must I include https://?
Without a scheme, a browser parser can interpret text as a relative path instead of a host. Add the full scheme to get a reliable result.
02What is the difference between origin and URL?
Origin is the scheme, hostname, and port. A URL also includes the path, query, and fragment.
03Are query parameters private?
No. They can appear in browser history, logs, analytics, referrer headers, and shared links. Keep secrets out of a query string.
KEEP BUILDINGMore small tools,