Skip to content

URL Checker

Paste any link to break it into its parts and see what it is really made of. Everything is parsed in your browser — the URL is never sent to Zurl.

Everything is parsed in your browser. Nothing is sent to Zurl.

Reading a URL properly

Most people read a URL left to right and stop at the first recognisable word. That instinct is exactly what link-disguising techniques exploit, because the part that determines where you actually go is not necessarily the part that catches your eye.

The authoritative part is the host: the section immediately after :// and before the next /. Everything after that first single slash is a path on that host and is controlled by whoever runs it.

Three patterns worth recognising

Credentials before the host. In https://apple.com@evil.example.com/login, the destination is evil.example.com. Everything before the @ is a username. The familiar name is decoration.

Subdomains that imitate a domain. In https://apple.com.security-check.example.net/, the real domain is example.net. Read hostnames from the right: the last two labels are what matter.

Visually identical characters. Some non-Latin characters render identically to Latin ones. A domain can look exactly like a familiar brand and be a completely different registration. The checker flags these as punycode.

Query parameters

The checker lists every query parameter separately, which is useful for two reasons. Long parameter strings often hide a second URL inside them — a redirect target — and reviewing them individually makes that visible. It is also how you confirm that campaign tags are present and spelled correctly before sharing a link.

If you are adding campaign parameters rather than checking them, the UTM builder constructs them correctly.

What structure cannot tell you

A well-formed URL on a legitimate-looking domain can still be hostile, and an ugly URL can be entirely fine. This tool narrows uncertainty; it does not remove it. For shortened links, resolve them first with the URL expander.

Frequently asked questions

Is the URL I paste sent to Zurl?
No. The URL checker parses everything in your browser using the built-in URL parser. Nothing is transmitted, logged or stored. That is deliberate — people paste links here precisely because they are unsure about them.
What does it check for?
It separates the URL into its components and flags several patterns commonly used to disguise a destination: embedded credentials before the @ sign, punycode domains containing non-ASCII characters, raw IP addresses instead of domain names, unusual subdomain depth, and unencrypted http connections.
What are embedded credentials in a URL?
A URL can contain a username and password before the host, as in https://apple.com@evil.example.com/. Everything before the @ is credentials, not the destination — the actual host here is evil.example.com. It reads as a trusted domain at a glance, which is exactly the point. Zurl refuses to shorten URLs containing credentials.
What is a punycode domain?
Punycode encodes non-ASCII characters in domain names, producing hostnames beginning xn--. It exists for legitimate internationalised domains, but it also allows characters that look identical to Latin letters, so a domain can be visually indistinguishable from a familiar one while being entirely different.
Does a clean result mean the link is safe?
No. This tool analyses structure, not reputation or content. A URL can be perfectly well-formed and still lead somewhere harmful. Zurl does not scan pages for malware or phishing.
Can I check a shortened link here?
You can inspect its structure, but the destination stays hidden because a short link contains no information about where it leads. Use the URL expander first to resolve it, then check the result here.