Enter a URL
Choose a crawler or browser User-Agent, or paste HTML directly.
Analyze HTML links, hidden encoded URLs, schemas, JavaScript, CSS and images in one place. Choose a User-Agent or paste your own HTML source.
Fetch HTML once, then explore every module without additional crawl requests.

Fetching the response and preparing your analysis.
Results represent the HTML returned to the chosen User-Agent. Encoded URLs are identified statically. The original payload and HTML source location are displayed, but their presence does not prove a visible hyperlink or malicious cloaking. External resource downloads use bounded HTTP requests and may be blocked by target sites.
Choose a crawler or browser User-Agent, or paste HTML directly.
Fetch one HTML response. Links, schema, scripts and images are parsed in your browser.
Use tabs to inspect results, copy URLs or download lists and source.
No. It reads the HTTP response and parses HTML without executing the website's JavaScript. Links generated later by dynamic JavaScript may not appear.
Yes. It scans inline scripts using bounded static decoding for Base64, URL encoding, HTML entities, character codes, and hex/Unicode escapes. Each result shows its original value, HTML line, and source code location. Dynamic JavaScript is not executed.
No. Fetching uses temporary memory, and downloads are sent directly to your browser. No application cache, stored crawl history or generated server files are created. Normal server access/error logs may still exist.
Five URL analyses per minute per IP, with a shared maximum of four active server crawls across HTML Analyzer and Cloaking Checker. JS/CSS/image downloads share a separate 10-per-minute-per-IP limit. HTML/JS/CSS responses are limited to 2 MB; images to 4 MB.