URL inspector - take a link apart before you click it
Split a link into its real destination, its tracking junk, and the redirect buried in the query string.
Nothing leaves your browser. This tool does its work on your own machine — there is no upload, no server request, and nothing is stored.
Where a link can lie to you
The @ trick
In a URL, anything between the scheme and an @ is a username, not a
destination. So https://www.yourbank.com@evil.test/login goes to
evil.test, and the bank's name is just a username being sent along
with the request. This is legal URL syntax that has existed for decades, and it
remains one of the most effective disguises there is because the real domain sits
where nobody reads.
The rule that always works: the real host is whatever comes immediately before the first single slash, reading left to right, ignoring everything before an @.
The brand-in-the-subdomain trick
yourbank.com.account-verify.test is not a yourbank.com address. It is a
subdomain of account-verify.test, and anyone who owns that domain can
create it in seconds at no cost. Read a hostname from the right: the last
two labels are the domain, everything before them was chosen freely by whoever owns
it.
A link inside the link
Many legitimate sites accept a ?next= or ?redirect=
parameter so they can return you somewhere after login. Attackers use exactly that
feature to borrow a trusted domain's reputation: the link you see and hover really
is the trusted site, and the trusted site then forwards you elsewhere. This tool
decodes any URL it finds hiding inside a parameter and shows it separately.
Tracking parameters
utm_source, fbclid, gclid and their relatives
tell the destination which ad, email or post you came from. They are not dangerous,
but they are not needed either — the cleaned link shown in the result is the same
page without them.
The limit of reading a link
Everything above is visible in the text. What is not visible is where the link actually ends up after the server responds, since a redirect can point anywhere and can change between one visit and the next. For that, paste the link into the full check: it follows the chain, records each hop, and scores the destination against blocklists and registration history.
Common questions
How can a link show one domain and open another?
The commonest trick uses the userinfo field. Everything before an @ in the host part is a username, not a destination, so https://example.com@evil.test goes to evil.test. Another is a redirect parameter, where the real target is a second URL encoded inside the query string.
What are the utm_ parameters in my links?
Campaign tracking tags added by marketing tools. They tell the destination site which ad or newsletter you came from. They are not dangerous, but they are usually safe to delete, and this tool shows you the link without them.
Does the inspector open the link?
No. It parses the text you paste, in your browser. If you want the redirect chain actually followed and the destination scored, run the link through the main check on the homepage instead.