What do you need to do?

Pick a job and you get one box to paste into and one answer back. Everything runs in this tab — nothing is uploaded.

Or paste anything here and urlforge picks the job

Encoding scheme

Keep decoding until it stops changing Replace undecodable bytes instead of failing Treat each line separately

Workbench

Input

Characters 0 · UTF-8 bytes 0

Output

Characters 0 · UTF-8 bytes 0 · Change 0%

What changed, character by character

0

Highlighted cells were rewritten. The row underneath shows what each one became.

Encoding layers

—

The URL

Parts

Findings

—

Query parameters

Read + as a space

	Name	Value (decoded)	Raw	Notes

Path segments

#	Raw	Decoded

Compare with another URL

One operation, every line

Remove duplicates Sort the result Skip blank lines

Download as

Input lines

Lines 0

Result

Lines 0 · Failed 0

Drop in a .har file

—

In your browser’s network panel, right-click and “Save all as HAR”. Drop the file here — or anywhere on this page — and every URL in it gets taken apart at once. The file is read in this tab and never sent anywhere.

Method	Status	URL	Findings

The request

Headers

Body

Start from a curl command

Paste what your browser's “Copy as cURL” gave you. Line continuations, quoting and --data-urlencode are handled.

Snippet

OAuth 2.0 authorisation URL

Authorisation endpoint Client ID Redirect URI Scope Response type State code_verifier code_challenge (S256)

Read a callback URL

Keys and payloads stay in this tab. Nothing here reaches the network, which is the only sane way to work with a signing secret.

AWS Signature Version 4

Presigned URL S3 (path encoded once)

Region Service Access key ID Secret access key

Session token (optional) X-Amz-Date Expires (seconds) Payload hash

Extra headers, one per line Payload

Canonical request

—

String to sign

How the signing key is derived

Authorization header

Webhook signature

Raw body, byte for byte as it arrived

Signing secret Signature header

Azure Blob shared access signature

Account Container Blob (optional) Permissions Starts (UTC) Expires (UTC) Protocol Service version

Account key (Base64)

String to sign

Signed URL

Read a SAS URL someone handed you

Google Cloud Storage V4 signed URL

Bucket Object Method Expires (seconds)

Service account e-mail Private key (PKCS#8 PEM, from the service-account JSON)

Canonical request

Signed URL

URL templates (RFC 6570)

The notation OpenAPI and the GitHub API hand you: {id}, {/path*}, {?q,page}. Fill it in below, or paste a finished URL at the bottom to get the values back out.

Template Values

Expanded

Or paste a finished URL and get the values back

The data

Show it decoded

The same data, as each framework writes it

Framework	Query string

OpenAPI parameter styles

style	explode	Primitive	Array	Object

Read a query string back

Will the browser allow this cross-origin request?

The page making the request (Origin) The URL it is asking for

Sends cookies or auth

Request headers it sets

What the server answered with

Set-Cookie

One Set-Cookie header per line

Follow a redirect chain

Where it starts The method it starts with

Each hop: status, then Location

#	Status	Method	Where it lands

Will this be cached, and for how long?

Request headers Response headers

Status code Request carried Authorization

In the browser

In a CDN or shared cache

Content-Security-Policy

Directive	Sources

Text, Base64 and hex

0 B

Text Base64 Base64URL Hex

Query string and JSON

Read + as a space

Query string JSON

Timestamps

Unix seconds Unix milliseconds ISO 8601 (UTC) Local time

Hash and HMAC

Message HMAC key (leave empty for a plain hash)

Turn a URL into a QR code

Dark

Text or URL

Read a QR code

—

Choose a photo or a screenshot you already have, or point the camera at a code and see where it actually leads.

Generators

Turn a title into a slug

Peek inside a JWT

Open jwtforge

This only decodes. Signatures are never checked here — use jwtforge for that.

Which characters survive, and where

RFC 3986 splits characters into unreserved ones, which never need escaping, and reserved ones, which carry meaning in some part of a URL and must be escaped everywhere else. A green tick means the character can appear literally in that component.

Char	Code	Name	Class	encodeURIComponent	encodeURI	Form	Path	Query	Fragment

Does this build work in your browser?

—

urlforge carries its own conformance checks — the AWS test vector, the eleven expansion examples from RFC 6570, a QR code decoded back through your browser, known hash digests. They run here, on your machine, with no network. If something in this build is wrong where you are, this is how you find out.

Result	Check	Detail