~/tools $ ./urlparse
URL Inspector
Break a URL into parts the way a browser does and flag disguised hosts, embedded credentials, and redirect parameters.
Runs entirely in your browser. Nothing you paste is sent anywhere.
Parts
Query parameters (decoded)
Findings
Parsers disagree
This tool uses your browser's WHATWG URL parser, the same one that decides where a click goes. Server-side libraries in Python, Java, PHP, and Go do not always agree with it, and those differences are the root of many SSRF and open redirect bypasses. If a filter and a fetcher parse a URL differently, the filter loses.
Phishing triage
Read the host right to left. In https://paypal.com.account-verify.test/ the real domain isaccount-verify.test. Everything before an @ in the authority is ignored for routing.