URL Checker
Paste any link to break it into its parts and see what it is really made of. Everything is parsed in your browser — the URL is never sent to Zurl.
Everything is parsed in your browser. Nothing is sent to Zurl.
Reading a URL properly
Most people read a URL left to right and stop at the first recognisable word. That instinct is exactly what link-disguising techniques exploit, because the part that determines where you actually go is not necessarily the part that catches your eye.
The authoritative part is the host: the section immediately after :// and before the next /. Everything after that first single slash is a path on that host and is controlled by whoever runs it.
Three patterns worth recognising
Credentials before the host. In https://apple.com@evil.example.com/login, the destination is evil.example.com. Everything before the @ is a username. The familiar name is decoration.
Subdomains that imitate a domain. In https://apple.com.security-check.example.net/, the real domain is example.net. Read hostnames from the right: the last two labels are what matter.
Visually identical characters. Some non-Latin characters render identically to Latin ones. A domain can look exactly like a familiar brand and be a completely different registration. The checker flags these as punycode.
Query parameters
The checker lists every query parameter separately, which is useful for two reasons. Long parameter strings often hide a second URL inside them — a redirect target — and reviewing them individually makes that visible. It is also how you confirm that campaign tags are present and spelled correctly before sharing a link.
If you are adding campaign parameters rather than checking them, the UTM builder constructs them correctly.
What structure cannot tell you
A well-formed URL on a legitimate-looking domain can still be hostile, and an ugly URL can be entirely fine. This tool narrows uncertainty; it does not remove it. For shortened links, resolve them first with the URL expander.
Frequently asked questions
- Is the URL I paste sent to Zurl?
- No. The URL checker parses everything in your browser using the built-in URL parser. Nothing is transmitted, logged or stored. That is deliberate — people paste links here precisely because they are unsure about them.
- What does it check for?
- It separates the URL into its components and flags several patterns commonly used to disguise a destination: embedded credentials before the @ sign, punycode domains containing non-ASCII characters, raw IP addresses instead of domain names, unusual subdomain depth, and unencrypted http connections.
- What are embedded credentials in a URL?
- A URL can contain a username and password before the host, as in https://apple.com@evil.example.com/. Everything before the @ is credentials, not the destination — the actual host here is evil.example.com. It reads as a trusted domain at a glance, which is exactly the point. Zurl refuses to shorten URLs containing credentials.
- What is a punycode domain?
- Punycode encodes non-ASCII characters in domain names, producing hostnames beginning xn--. It exists for legitimate internationalised domains, but it also allows characters that look identical to Latin letters, so a domain can be visually indistinguishable from a familiar one while being entirely different.
- Does a clean result mean the link is safe?
- No. This tool analyses structure, not reputation or content. A URL can be perfectly well-formed and still lead somewhere harmful. Zurl does not scan pages for malware or phishing.
- Can I check a shortened link here?
- You can inspect its structure, but the destination stays hidden because a short link contains no information about where it leads. Use the URL expander first to resolve it, then check the result here.