{ "run_id": "edit-e1-per-label-2026-10-24", "environment": { "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36", "platform": "MacIntel", "device_pixel_ratio": 2, "date_utc": "2026-10-25T01:40:55.921Z", "user_agent_data": { "architecture": "arm", "brands": [ { "brand": "Google Chrome", "version": "155" }, { "brand": "Chromium", "version": "155" }, { "brand": "Not(A:Brand", "version": "24" } ], "fullVersionList": [ { "brand": "Google Chrome", "version": "155.0.8059.80" }, { "brand": "Chromium", "version": "155.0.8059.80" }, { "brand": "Not(A:Brand", "version": "24.0.0.0" } ], "mobile": false, "platform": "macOS", "platformVersion": "27.0.1" } }, "device": "MacBook Air M4, 32 GB RAM", "local_date": "2026-10-24", "revision": "Per-label script detection; Common and Inherited ignored", "cases": [ { "case_id": "userinfo-port-query", "record": { "recorded_utc": "2026-10-25T01:47:47.450Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nUserinfo is present before @. It is not the destination hostname.\nPercent-encoding is present. Parsed fields and decoded query values may look different from the input.\nA non-default port is present: 8443. This is not a reputation verdict.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\tshop.example.test\nHostname: Unicode\tshop.example.test\nPublic suffix\ttest\nRegistrable-domain boundary\texample.test\nSubdomains\tshop\nPSL rule\t* (default; no listed suffix match)\nPort\t8443\nPath\t/a%20b\nRaw query\t?x=1&x=2&token=example-only\nFragment\t#section\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nx\t1\nx\t2\ntoken\texample-only\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://trusted.example.test@shop.example.test:8443/a%20b?x=1&x=2&token=example-only#section" } ] } }, { "case_id": "unicode-mixed", "record": { "recorded_utc": "2026-10-25T01:47:49.652Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nMixed scripts in label “раypal”: Latin, Cyrillic. This alone does not establish deception.\nPossible lookalike characters: р resembles p; а resembles a. This is a limited visual check.\nNon-ASCII hostname: compare both representations. The character checks are not exhaustive.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\txn--ypal-43d9g.example.test\nHostname: Unicode\tраypal.example.test\nPublic suffix\ttest\nRegistrable-domain boundary\texample.test\nSubdomains\txn--ypal-43d9g\nPSL rule\t* (default; no listed suffix match)\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://раypal.example.test/" } ] } }, { "case_id": "idn-single-script", "record": { "recorded_utc": "2026-10-25T01:47:50.816Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nNon-ASCII hostname: compare both representations. The character checks are not exhaustive.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\txn--bcher-kva.example.test\nHostname: Unicode\tbücher.example.test\nPublic suffix\ttest\nRegistrable-domain boundary\texample.test\nSubdomains\txn--bcher-kva\nPSL rule\t* (default; no listed suffix match)\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://bücher.example.test/" } ] } }, { "case_id": "ip-v4", "record": { "recorded_utc": "2026-10-25T01:47:52.687Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nThe hostname is an IP address; a registrable-domain boundary does not apply.\nA non-default port is present: 8080. This is not a reputation verdict.\nParsed address fields\nScheme\thttp:\nHostname: ASCII / punycode\t192.0.2.1\nHostname: Unicode\t192.0.2.1\nPublic suffix\tNot applicable\nRegistrable-domain boundary\tNot applicable\nSubdomains\tNot applicable\nPSL rule\tNo DNS-name suffix lookup\nPort\t8080\nPath\t/path\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "http://192.0.2.1:8080/path" } ] } }, { "case_id": "ip-v6", "record": { "recorded_utc": "2026-10-25T01:47:54.834Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nThe hostname is an IP address; a registrable-domain boundary does not apply.\nA non-default port is present: 8443. This is not a reputation verdict.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\t[2001:db8::1]\nHostname: Unicode\t[2001:db8::1]\nPublic suffix\tNot applicable\nRegistrable-domain boundary\tNot applicable\nSubdomains\tNot applicable\nPSL rule\tNo DNS-name suffix lookup\nPort\t8443\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://[2001:db8::1]:8443/" } ] } }, { "case_id": "psl-private", "record": { "recorded_utc": "2026-10-25T01:47:56.685Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nNone of these structural flags matched. That does not establish trust.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\tone.two.blogspot.com\nHostname: Unicode\tone.two.blogspot.com\nPublic suffix\tblogspot.com\nRegistrable-domain boundary\ttwo.blogspot.com\nSubdomains\tone\nPSL rule\tblogspot.com\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://one.two.blogspot.com/" } ] } }, { "case_id": "psl-wildcard", "record": { "recorded_utc": "2026-10-25T01:47:58.726Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nNone of these structural flags matched. That does not establish trust.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\ta.b.ck\nHostname: Unicode\ta.b.ck\nPublic suffix\tb.ck\nRegistrable-domain boundary\ta.b.ck\nSubdomains\tNone\nPSL rule\t*.ck\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://a.b.ck/" } ] } }, { "case_id": "psl-exception", "record": { "recorded_utc": "2026-10-25T01:48:07.176Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nNone of these structural flags matched. That does not establish trust.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\ta.www.ck\nHostname: Unicode\ta.www.ck\nPublic suffix\tck\nRegistrable-domain boundary\twww.ck\nSubdomains\ta\nPSL rule\t!www.ck\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://a.www.ck/" } ] } }, { "case_id": "suffix-only", "record": { "recorded_utc": "2026-10-25T01:48:08.584Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nNone of these structural flags matched. That does not establish trust.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\tco.uk\nHostname: Unicode\tco.uk\nPublic suffix\tco.uk\nRegistrable-domain boundary\tNone: hostname is a suffix or single label\nSubdomains\tNone\nPSL rule\tco.uk\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://co.uk/" } ] } }, { "case_id": "relative-rejected", "record": { "recorded_utc": "2026-10-25T01:48:14.565Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nInclude an explicit scheme, such as https:. No base address is guessed.\n\nStructural flags\nParsed address fields\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "/example/path" } ] } }, { "case_id": "invalid-rejected", "record": { "recorded_utc": "2026-10-25T01:48:18.598Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nThe browser URL parser rejected this input. Nothing was opened.\n\nStructural flags\nParsed address fields\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://[broken/" } ] } }, { "case_id": "markup-text", "record": { "recorded_utc": "2026-10-25T01:48:22.551Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nPercent-encoding is present. Parsed fields and decoded query values may look different from the input.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\texample.test\nHostname: Unicode\texample.test\nPublic suffix\ttest\nRegistrable-domain boundary\texample.test\nSubdomains\tNone\nPSL rule\t* (default; no listed suffix match)\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t?q=%3Cscript%3Ealert(1)%3C/script%3E\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nq\t\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://example.test/?q=%3Cscript%3Ealert(1)%3C/script%3E" } ] } }, { "case_id": "default-port", "record": { "recorded_utc": "2026-10-25T01:48:27.081Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nNone of these structural flags matched. That does not establish trust.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\texample.test\nHostname: Unicode\texample.test\nPublic suffix\ttest\nRegistrable-domain boundary\texample.test\nSubdomains\tNone\nPSL rule\t* (default; no listed suffix match)\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://example.test:443/" } ] } }, { "case_id": "empty-label", "record": { "recorded_utc": "2026-10-25T01:48:29.332Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nThe hostname contains an empty label after removing one terminal dot. Its registrable-domain boundary is not determined.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\texample..com\nHostname: Unicode\texample..com\nPublic suffix\tNot determined\nRegistrable-domain boundary\tNot determined\nSubdomains\tNot determined\nPSL rule\tEmpty hostname label; no suffix lookup\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://example..com/" } ] } }, { "case_id": "double-terminal-dot", "record": { "recorded_utc": "2026-10-25T01:48:51.024Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nThe hostname contains an empty label after removing one terminal dot. Its registrable-domain boundary is not determined.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\twww.example.com..\nHostname: Unicode\twww.example.com..\nPublic suffix\tNot determined\nRegistrable-domain boundary\tNot determined\nSubdomains\tNot determined\nPSL rule\tEmpty hostname label; no suffix lookup\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://www.example.com../" } ] } }, { "case_id": "single-terminal-dot", "record": { "recorded_utc": "2026-10-25T01:48:54.202Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nNone of these structural flags matched. That does not establish trust.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\twww.example.com.\nHostname: Unicode\twww.example.com.\nPublic suffix\tcom\nRegistrable-domain boundary\texample.com\nSubdomains\twww\nPSL rule\tcom\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://www.example.com./" } ] } }, { "case_id": "cyrillic-label-latin-tld", "record": { "recorded_utc": "2026-10-25T01:48:57.040Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nPossible lookalike characters: р resembles p; е resembles e. This is a limited visual check.\nNon-ASCII hostname: compare both representations. The character checks are not exhaustive.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\txn--e1afmkfd.com\nHostname: Unicode\tпример.com\nPublic suffix\tcom\nRegistrable-domain boundary\txn--e1afmkfd.com\nSubdomains\tNone\nPSL rule\tcom\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://пример.com/" } ] } }, { "case_id": "cyrillic-label-cyrillic-tld", "record": { "recorded_utc": "2026-10-25T01:49:01.449Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nPossible lookalike characters: р resembles p; е resembles e. This is a limited visual check.\nNon-ASCII hostname: compare both representations. The character checks are not exhaustive.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\txn--e1afmkfd.xn--p1ai\nHostname: Unicode\tпример.рф\nPublic suffix\txn--p1ai\nRegistrable-domain boundary\txn--e1afmkfd.xn--p1ai\nSubdomains\tNone\nPSL rule\txn--p1ai\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://пример.рф/" } ] } }, { "case_id": "mixed-label-apple", "record": { "recorded_utc": "2026-10-25T01:49:03.795Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nMixed scripts in label “аpple”: Latin, Cyrillic. This alone does not establish deception.\nPossible lookalike characters: а resembles a. This is a limited visual check.\nNon-ASCII hostname: compare both representations. The character checks are not exhaustive.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\txn--pple-43d.com\nHostname: Unicode\tаpple.com\nPublic suffix\tcom\nRegistrable-domain boundary\txn--pple-43d.com\nSubdomains\tNone\nPSL rule\tcom\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://аpple.com/" } ] } }, { "case_id": "punycode-cyrillic-label", "record": { "recorded_utc": "2026-10-25T01:49:05.617Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nPossible lookalike characters: а resembles a; р resembles p; е resembles e. This is a limited visual check.\nNon-ASCII hostname: compare both representations. The character checks are not exhaustive.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\txn--80ak6aa92e.com\nHostname: Unicode\tаррӏе.com\nPublic suffix\tcom\nRegistrable-domain boundary\txn--80ak6aa92e.com\nSubdomains\tNone\nPSL rule\tcom\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://xn--80ak6aa92e.com/" } ] } }, { "case_id": "latin-sharp-s", "record": { "recorded_utc": "2026-10-25T01:49:07.667Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nParsed locally. No destination was requested. This tool cannot tell whether a site is safe.\n\nStructural flags\nNon-ASCII hostname: compare both representations. The character checks are not exhaustive.\nParsed address fields\nScheme\thttps:\nHostname: ASCII / punycode\txn--fa-hia.de\nHostname: Unicode\tfaß.de\nPublic suffix\tde\nRegistrable-domain boundary\txn--fa-hia.de\nSubdomains\tNone\nPSL rule\tde\nPort\tNone explicitly retained; the parser removes a scheme-default port\nPath\t/\nRaw query\t(empty)\nFragment\t(empty)\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nNo query parameters\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "https://faß.de/" } ] } } ], "clear_check": { "performed_after_network_window": true, "record": { "recorded_utc": "2026-10-25T01:49:24.858Z", "component_path": "/demos/tools/url-inspector/", "title": "Inspect a URL without visiting it", "text": "Inspect a URL without visiting it\n\nThis tool cannot tell whether a site is safe. It does not scan, resolve or open the address.\n\nPaste an absolute URL, then choose Inspect. Processing stays in this page. The tool does not store your input or send it to a service.\n\nURL to inspect \nInspect Clear\n\nInput and results cleared from this page.\n\nStructural flags\nParsed address fields\nQuery parameters in input order, including duplicates\nName (decoded)\tValue (decoded)\nWhat the output means\n\nThe hostname comes from this browser's URL parser. The Unicode display is decoded from its punycode labels. Query values use URLSearchParams decoding; the raw query remains visible above.\n\nThe registrable-domain boundary uses both ICANN and private sections of a pinned Public Suffix List. It does not establish ownership, registration, reputation or the address reached after a redirect.\n\nThe mixed-script check examines each hostname label separately across thirteen named scripts. Common and Inherited characters, including digits and hyphens, do not contribute a script. A different script in the top-level label does not create a mixed-script flag in another label. The small lookalike set is a visual prompt, not comprehensive spoof detection. Internationalized names and non-default ports can be legitimate.\n\nNothing you paste becomes a clickable link. Clear removes the current input and output; it cannot control browser extensions, clipboard history or other software on your device.\n\nPublic Suffix List snapshot: 2026-10-22_08-36-41_UTC. The bundled list is licensed under Mozilla Public License 2.0; source and licence are included with the package. Original tool code is MIT licensed.", "viewport": { "width": 1248, "height": 700, "document_width": 1248 }, "regions": [], "active_element": { "tag": "BODY", "id": "" }, "link_count": 0, "input_values": [ { "id": "url-input", "value": "" } ] }, "focus_observation_before_record_button": { "focused": true, "value": "" } }, "network": { "schema": "resource-timing-action-log-v1", "component_path": "/demos/tools/url-inspector/", "start": { "utc": "2026-10-25T01:41:40.685Z", "time_ms": 44761.90000003576 }, "end": { "utc": "2026-10-25T01:49:08.588Z", "time_ms": 492662.40000003576 }, "baseline_resource_count": 0, "requests_during_window": 0, "requests": [], "csp_violations": [], "scope": "Resource Timing for the component document only; initial navigation excluded; not a packet capture, DNS log or browser-wide traffic capture." }, "earlier_run": "url-inspector-browser.json", "license": "CC-BY-4.0" }