URL Security Analyzer
Visualize URL security threats. Detect multi-layer encoding, phishing domains, query parameter analysis, and URL/Base64 encoding & decoding.
Last updated:
How to Use
Expand how to useCollapse how to use
- 1
Enter a URL
Paste or type a URL into the input field. Use the Sample button to try an example.
- 2
Review analysis
Security warnings, URL structure, query parameters, and encoding layers are displayed automatically.
- 3
Encode & decode
Use the tools at the bottom to manually perform URL encoding/decoding or Base64 encoding/decoding.
URL Input
Encode / Decode
All processing happens in your browser. URLs and text are never sent to a server.
About URL Security Analyzer
URL Security Analyzer makes it safe to inspect a suspicious link without clicking it. Paste any URL to automatically detect phishing domain spoofing, IDN homograph attacks, multi-layer encoding used to bypass WAFs, XSS vectors embedded in javascript: or data: URIs, and open redirect parameters. The tool also breaks down the full URL structure and lets you manually encode or decode URL and Base64 strings.
Key Features
- Multi-layer encoding detection (WAF bypass attack detection)
- IDN homograph attack detection (Cyrillic/Greek character impersonation)
- Subdomain spoofing detection (e.g., google.com.evil.org)
- javascript:/data: URI detection (XSS risk)
- Open redirect pattern detection
- Automatic Base64 decoding of query parameters
- URL/Base64 encoding and decoding tools
Use Cases
- Inspect suspicious links from phishing emails before clicking
- Decode obfuscated URLs found in malware samples or spam
- Test web application inputs for open redirect or XSS vulnerabilities
- Decode URL-encoded or Base64-encoded query parameters when debugging APIs
- Verify that redirect URLs in OAuth flows don't expose open redirect risks
FAQ
What is multi-layer encoding?
A state where a URL has been encoded multiple times. This technique is commonly used by attackers to bypass WAFs (Web Application Firewalls), where repeated decoding may reveal a malicious URL.
What is a homograph attack?
An attack that impersonates legitimate domains using visually similar but different characters (e.g., Cyrillic 'а' vs Latin 'a'). A URL that looks like apple.com may actually be a completely different domain. Always check the actual characters in the hostname, not just how they look.
Is data sent to a server?
No. URL parsing and encoding use standard browser JavaScript APIs. Input data is not transmitted to any server.
How do I safely inspect a suspicious link without clicking it?
Copy the link text (right-click > Copy Link Address) without clicking it, then paste it into this tool. The analyzer will decode and break down the URL structure so you can inspect the actual destination, query parameters, and any hidden encoding layers.