URL Validator

How the URL Validator works

URL validator: check the syntax before the link breaks

A malformed URL fails quietly. In a CMS export, a sitemap or a redirect map, a bad entry becomes a dead link, a redirect that never fires or a page a crawler skips, and nobody sees an error. This validator checks syntax, not the destination. It asks whether a browser or HTTP library will parse each line as an absolute URL. The rules follow RFC 3986, the IETF standard for URI syntax, with hostname rules from DNS.

Scheme and separators

Every absolute URL starts with a scheme: a letter, then letters, digits, plus, hyphen or dot, then a colon. RFC 3986 defines it that way. example.com/page has no scheme. The address bar adds https:// for you, but an href, a Location header, a sitemap or a fetch() call does not, so the string is resolved as a relative path. https:/example.com with one slash and https:example.com with none are both errors.

Schemes outside the common list, such as custom app schemes, get a note rather than an error. The mailto:, tel:, sms: and data: forms are checked against their own shapes. javascript: is an error, because it is not a web address.

Hostnames

A hostname may contain letters, digits, hyphens and dots. Each label is at most 63 characters and neither starts nor ends with a hyphen. The whole host is at most 253 characters. Underscores are the most common mistake. They are legal in some DNS records, such as SRV names, but not in hostnames, so my_site.example.com is an error.

The last label must be at least two letters, so c0m is an error. A single label such as intranet gets a note that it only resolves on a local network. Capitals are noted because hostnames are case-insensitive. International names such as münchen.de get a note, because browsers convert them to punycode.

IPv4 addresses must have four parts, each from 0 to 255. A leading zero is flagged, since some parsers read it as octal. Private and loopback ranges, such as 10., 192.168., 127. and 169.254., get a note. IPv6 must sit in square brackets, with eight groups, or fewer with one ::.

Port, credentials and the rest

A port must be a number from 1 to 65535. Port 0 is an error. Port 80 on http and 443 on https are noted as redundant. A user:password@ before the host gets a note, since it puts a credential into logs, history and referrers.

Whitespace anywhere in the path, query or fragment is an error. Use %20, or + in a query. Every % must be followed by two hex digits, so /100% is broken until it is written /100%25. RFC 3986 does not allow ", <, >, \, ^, backtick, {, | or } in a URL, and browsers accept them anyway, so they get a note. A second # in the fragment is an error.

In the query, repeated keys, empty parameters from a stray && and keys with no = are noted. A path with //, . or .. segments is noted, because it usually comes from a bad string join. Relative paths, protocol-relative URLs and three slashes after the scheme are errors.

Errors and notes

Each line gets one of three results. Invalid means at least one error. Valid, with notes means no errors but something a careful reviewer would mention, such as plain http, a private address, a URL over 2048 characters or a character the browser will rewrite. Valid means neither. A note does not block a URL from working.

How to read the results

The summary shows URLs checked, Valid (which includes notes), Invalid and With notes. The table lists each line with its result and a Details column. Errors come first in Details, then notes, separated by semicolons. Read the Details text, because it names the exact character or part.

Input is split on line breaks and each line is checked alone, so a URL pasted across two lines becomes two invalid entries. Leading and trailing spaces are trimmed before checking.

What it does not do

Nothing is fetched. The validator cannot tell you whether a page returns 200, 404 or a redirect, and it does not check that a domain is registered. For the response, use the HTTP status reference and a real request. For the DNS side, see the DNS records guide. To see the parameters in a query string, use the URL query parser.

Related tools