Your files never leave your device. All processing happens locally in your browser.
How can I find broken links in my HTML or a URL list without a server, and why can’t a browser fully check external links?
Open AnyTool’s Broken Link Finder, paste your page’s HTML source (View Source / Ctrl+U) or a plain list of URLs, optionally add your base URL, and it EXTRACTS every link (from HTML via a DOMParser walk of every <code><a href></code>, or line-by-line from a URL list) and VALIDATES each URL’s FORMAT — flagging malformed URLs, a missing protocol, spaces / whitespace, an <code>http://</code> link on an <code>https://</code> site, <code>javascript:</code> / empty / <code>#</code>-only hrefs, <code>localhost</code> or private IPs, un-filled <code>{{templates}}</code>, overly-long URLs and duplicate targets. Each link is rated valid / suspicious / invalid with the exact reasons, and you get a summary, filters, an “Open ↗” to verify each link manually, and a CSV export — all 100% in your browser, nothing uploaded. It also offers an OPTIONAL reachability probe, but it’s clearly caveated: a browser CANNOT reliably tell a real 404 from a CORS block, so most cross-origin checks are inconclusive. For a true site-wide broken-link crawl that reads real HTTP status codes, use a server-side crawler (Screaming Frog, paid SEO suites, W3C Link Checker).
Paste page HTML or a URL list → every link is extracted, no crawling
Each link rated valid / suspicious / invalid + a filterable table + CSV export
Open ↗ each link to verify it actually loads — format validation ≠ reachability
100% client-side; a browser can’t reliably check external links (CORS) — use a server crawler for a true crawl
What is
Broken link (dead link / 404)
A broken link is a hyperlink that points to a page or resource that no longer exists or cannot be reached — most commonly returning an HTTP 404 (Not Found) or 410 (Gone), but also 5xx server errors, timeouts, or a malformed URL that never resolves at all. Broken links hurt SEO in three ways: they waste crawl budget (search-engine bots spend limited crawl allowance hitting dead ends instead of your real pages), they waste link equity (the ranking authority a link would pass is lost when its target is dead), and they damage user experience (visitors who hit a 404 tend to bounce). Note that a browser cannot reliably detect a real 404 on an external URL because cross-origin requests are blocked by CORS; dedicated link checkers detect them server-side by reading the actual HTTP status code.
SEO & Web
Related terms
404 errorDead linkCrawl budgetLink equityHTTP status codeCORSLink checkerScreaming Frog
Frequently Asked Questions
They waste crawl budget on dead ends, lose the link equity the link would pass, and hurt user experience — visitors who hit a 404 bounce.
Broken links harm SEO in three connected ways. First, crawl budget: search engines allocate a limited number of crawls per site, and every broken link sends the bot to a dead end instead of a real page — if 5% of your internal links are broken, roughly 5% of your crawl budget is wasted. Second, link equity: the ranking authority (“link juice”) a link would pass is lost when its destination is dead, so a high-authority page with two broken outbound links out of ten leaks about 20% of the equity it could distribute. Third, user experience: a visitor who clicks through and lands on a 404 usually hits the back button, driving up bounce rate, which can signal to search engines that the page isn’t satisfying intent. Google says isolated 404s are normal and not a direct penalty, but the indirect fallout — wasted crawl budget, leaked equity and poor UX — is what erodes rankings over time.
Not reliably — a browser can’t. CORS blocks cross-origin reads and a failed fetch is indistinguishable from a real 404. It validates format and lets you open each link to verify.
A browser genuinely cannot reliably check whether an external link is broken, and this tool is honest about that. Cross-origin requests are blocked by the browser’s Same-Origin Policy / CORS, so JavaScript can’t read the HTTP status of another site’s URL; a <code>no-cors</code> fetch returns an OPAQUE response with status <code>0</code> and no readable headers, so a failed request cannot be told apart from a real 404. We also use no server proxy, which keeps your URLs private. What the tool does reliably instead is EXTRACT your links, VALIDATE their URL format (catching the malformed, mis-typed and placeholder URLs that are broken on their face), flag the suspicious ones, and give you an “Open ↗” link to verify each one manually. The optional reachability probe attempts a real fetch but reports cross-origin failures as “blocked (CORS)” — inconclusive, not proof of a 404.
They crawl server-side, outside the browser sandbox, sending HEAD/GET requests to each URL and reading the real HTTP status code (404, 410, 5xx).
Dedicated link checkers such as Screaming Frog SEO Spider, paid SEO suites Site Audit, Xenu’s Link Sleuth and the W3C Link Checker run server-side (or as a desktop app), outside the browser’s cross-origin sandbox, so they are not bound by CORS. They crawl your pages, extract every link, then send an HTTP request — usually a HEAD (or a GET when HEAD is rejected) — to each target URL and read the actual response status code, classifying anything in the 4xx range (like 404 Not Found) or 5xx range (server errors) as broken. They can also report the source page (“inlinks”) so you know exactly where to fix each dead link. Because they read the true status, they can confirm reachability in a way a browser tab cannot — which is why, for a true site-wide crawl, this tool points you to them.
Malformed URLs, a missing protocol, spaces/whitespace, http on an https site, javascript:/empty/#-only, localhost, un-filled {{templates}}, overly-long URLs and duplicates.
The format validation flags the classic signs of a link that will break or is broken on its face: a MALFORMED URL the browser can’t parse; a MISSING PROTOCOL (a bare “example.com/path” that may be treated as a relative path); SPACES or other whitespace inside the URL (browsers may not follow it); an <code>http://</code> link on an <code>https://</code> site (mixed content, often blocked); <code>javascript:</code> pseudo-URLs, empty hrefs and bare <code>#</code> placeholder links that go nowhere; <code>localhost</code> or private-IP links that work only on your machine and are dead in production; un-filled placeholders or template leftovers (<code>undefined</code>, <code>null</code>, <code>{{product_url}}</code>, <code>example.com</code>); overly-long URLs; and DUPLICATE targets. Each issue is explained in plain language and rolled into an overall valid / suspicious / invalid rating so you can fix the obvious problems before running a full crawl.
Detailed Explanation
📖How It Works
What the Broken Link Finder Does
The Broken Link Finder takes a page’s HTML source OR a plain list of URLs that the user PASTES and, entirely in the browser, EXTRACTS every link and VALIDATES each URL’s format. From HTML it reuses the shared, pure linkExtractEngine.ts (a DOMParser walk of every <a href>, recording the raw + resolved href, the anchor text and the link type — internal / external / mailto / tel / anchor / other); from a pasted list it parses one URL per line (tolerating numbered and bulleted lists). A new pure engine, brokenLinkEngine.ts, then runs validateFormat() on each URL and classifies it ok / warn / invalid with a plain-language list of the concrete issues found, and rolls up a summary (total / valid-format / suspicious / invalid / duplicates / openable). The page renders a filterable table — each row showing the anchor text, the URL, a format-status chip, the issue badges, and an “Open ↗” link to verify manually — plus filters, a CSV export and an OPTIONAL, clearly-caveated reachability probe. Nothing is crawled or uploaded; it reads only the text you paste.
Two inputs: paste page HTML (DOMParser walk of <a href>) or a plain URL list
Reuses the shared linkExtractEngine.ts; adds format validation in a new brokenLinkEngine.ts
Each URL rated valid / suspicious / invalid with the exact reasons in plain language
Summary + filters + per-link Open ↗ + CSV export, all client-side
No crawling and no upload — it reads only the text you paste
⚙️Methodology
The URL Format Checks It Runs
validateFormat() maps each check to a real-world cause of a broken or suspicious link. EMPTY / #-only / javascript: hrefs are placeholders that go nowhere (invalid or warned). WHITESPACE — spaces or tabs inside a URL — is the classic malformed-URL sign and browsers may refuse to follow it. NO PROTOCOL flags a bare “example.com/path” that could be treated as a relative path (relative links resolved against a supplied base URL are treated as fine). HTTP-ON-HTTPS flags an http:// link when the base URL is https:// (mixed content, often blocked). MALFORMED means the browser’s URL parser itself rejects the string. LOCALHOST / private-IP links (localhost, 127.0.0.1, 192.168.x, 10.x, 172.16–31.x) work only on your machine and are dead in production. PLACEHOLDER catches un-filled template leftovers (undefined, null, {{product_url}}, example.com). OVERLY-LONG flags URLs beyond ~2000 characters. UNENCODED flags characters that must be percent-encoded (< > " { } | \ ^ `). DUPLICATE flags the same target appearing more than once. Each link’s overall status is the worst of its issues, and a summary tallies valid / suspicious / invalid across all links.
Empty / #-only / javascript: → placeholder links that go nowhere
Spaces / whitespace and unencoded characters → likely malformed
No-protocol and http-on-https (mixed content) flagged; relative links resolved against the base
localhost / private IPs and un-filled {{templates}} → dead in production
Overly-long and duplicate targets flagged; overall status = worst issue
⚠️Limitations
A Browser Can’t Reliably Check External Links — Use a Server Crawler
The tool is explicit about the hard limit of any in-browser link checker: a browser CANNOT reliably check whether an external link is broken. Cross-origin requests are blocked by the Same-Origin Policy / CORS, so JavaScript cannot read the HTTP status of another site’s URL; a no-cors fetch returns an OPAQUE response with status 0 and no readable headers, so a failed request is indistinguishable from a real 404 — a working link and a dead one look identical. The optional checkReachability() probe therefore attempts fetch(url, {method:"HEAD", mode:"cors"}) and, when it throws, honestly reports “blocked (CORS) — inconclusive” rather than pretending the link is broken; it succeeds only for the rare targets that send CORS headers. No server proxy is used, which keeps your URLs private but also means cross-origin reachability stays inconclusive by design. Real link checkers — Screaming Frog SEO Spider, paid SEO suites Site Audit, Xenu’s Link Sleuth, the W3C Link Checker — run server-side, outside the browser sandbox, and send HEAD/GET requests to read the true status code (404 / 410 / 5xx), which is why the tool points you to them for a true site-wide crawl. Its reliable, private job is to extract your links, validate their FORMAT, flag the suspicious ones and let you open each to verify.
CORS blocks cross-origin reads; a no-cors fetch is opaque (status 0) — a 404 and a block look identical
checkReachability reports cross-origin failures as “blocked (CORS) — inconclusive”, not “broken”
No server proxy → your URLs stay private, but external reachability stays inconclusive
Real checkers (Screaming Frog, paid SEO suites, W3C) crawl server-side and read the true HTTP status
The tool’s reliable job: extract links, validate format, flag suspicious, open to verify
🔒Privacy & Security
Why Validating Links In-Browser Is a Privacy Win
Online link checkers fetch your pages and links server-side, which exposes which URLs you are auditing — including staging domains and any tokens or campaign parameters in them — to a third-party service. The Broken Link Finder instead runs entirely on the user’s device: the HTML or URL list you paste is parsed and validated with plain JavaScript, nothing is fetched, uploaded, logged or stored, and no site is contacted (there is deliberately no server proxy). The optional reachability probe fires only when you click it, keeps only a pass/fail result in memory, and still uses no proxy. That makes the tool safe to run on STAGING, INTERNAL or unreleased pages and on URL lists with private query strings, without sending them anywhere. It works offline once cached as a PWA, and closing the tab discards everything. It adds no new dependency: the extraction reuses the shared linkExtractEngine.ts and the validation lives in the small, reusable, well-typed brokenLinkEngine.ts, and it uses only custom in-house SVG icons and the shared ad and SEO components — the same golden pattern as its SEO & Web siblings.
HTML / URL list is validated locally and never uploaded — no server, no CDN, no crawl, no proxy
Safe for staging / internal pages and URL lists with private query strings
Optional reachability probe fires only on click and keeps only pass/fail in memory
Works offline once cached; closing the tab discards your data
No new dependency — reuses linkExtractEngine.ts, adds the pure brokenLinkEngine.ts
Broken-link finding: in-browser format check (AnyTool) vs online crawlers
Capability
AnyTool
Typical online / desktop crawlers
Processing
Runs entirely in your browser
Crawl your site server-side / desktop
Your links
Never uploaded, works offline
Sent to / read by the tool
Staging / private URLs
Safe — nothing leaves the device
Exposed, including query strings
Input
Paste HTML or a URL list
A URL / site the tool crawls
Extract links
Yes (DOMParser / URL list)
Yes (via crawl)
Format validation
Yes — malformed, http-on-https, placeholder, etc.
Varies
Read real HTTP status (404)
No (a browser can’t — CORS)
Yes (its main feature)
Honesty
Clear that external checks are inconclusive
Implies authoritative status
Cost / signup
Free, no signup
Often paid or gated
AnyTool extracts your links and validates their FORMAT locally and uploads nothing, which is safe for staging or private URLs, and lets you open each link to verify. A browser cannot reliably read whether an external link returns a 404 — cross-origin requests are blocked by CORS and a failed request is indistinguishable from a real 404 — and there is no server proxy, so this is not a live crawler; for a true site-wide broken-link crawl use a server-side crawler like Screaming Frog, paid SEO suites Site Audit or the W3C Link Checker. Comparison as of July 2026.