URL Password

Extract the password of an absolute URL using the WHATWG URL parser, including its normalization rules.

Description

A URL password is part of user information preceding the host.

A URL password is part of user information preceding the host. Its serialized value may contain percent escapes and is independent of whether the remote service supports that authentication method.^[1]

Extract the password of an absolute URL using the WHATWG URL parser, including its normalization rules.

When to use URL Password

Use this tool to extract the password of an absolute URL using the WHATWG URL parser, including its normalization rules.

Choose the URL, decoded source text, header value or explicit byte list requested by this tool. Paste the complete relevant input and follow its parsing and encoding conventions.

How to use URL Password and understand its results

Choose the URL, decoded source text, header value or explicit byte list requested by this tool. Paste the complete relevant input and follow its parsing and encoding conventions.
Enter url using the field table and calculation rules, then run the tool.
Read password. The explanation below defines the units, signs, ordering and any flags or placeholder values.
If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.

Input field	Meaning	Value type; see rules below	Requirement
url	Absolute URL to parse.	string; maximum length: 1000000	Required

Paste an absolute URL. Parse without a base and return the normalized password component, retaining percent encoding. No password returns an empty string; malformed or relative input returns an error.

password=WHATWG_URL(url).password

Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.

Output field	Meaning	Value type
password	Normalized URL password.	string; maximum length: 1000000

json

{
  "input": {
    "url": "https://reader:secret@EXAMPLE.com:8443/a/../guide?q=one&q=two#part"
  },
  "output": {
    "password": "secret"
  }
}

Limitations and assumptions

No credential decoding, server authentication or request is performed. The extracted string is not evidence of valid access.

Numeric inputs must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Extremely large text inputs are rejected. Missing required fields, extra fields, wrong value types and violations of the calculation rules are input errors.

Alternative or Complementary methods

Use URL Username: Extract the username of an absolute URL using the WHATWG URL parser, including its normalization rules. For a complementary task, use URL Host: Extract the host of an absolute URL using the WHATWG URL parser, including its normalization rules.

References

URL Password — tool.io

Similar or alternative tools

URL Username
Extract the username of an absolute URL using the WHATWG URL parser, including its normalization rules.
URL Host
Extract the host of an absolute URL using the WHATWG URL parser, including its normalization rules.