URL Encoder / Decoder

Percent-encoding, briefly

URLs may only contain a restricted set of ASCII characters. Anything outside that set, and any reserved character used with a meaning other than its structural one, must be percent-encoded: converted to UTF-8 bytes and written as % followed by two hexadecimal digits. A space becomes %20, an ampersand inside a value becomes %26, and an accented character becomes two or more bytes.

Encoding a component is not encoding a URI

This distinction causes most bugs. JavaScript exposes two functions. encodeURIComponent escapes everything that is not unreserved, including /, ?, &, = and #, and is what you want for a single query parameter value or path segment. encodeURI leaves those structural characters intact because it assumes it is being handed a complete URL. Using encodeURI on a parameter value is how an ampersand inside a value ends up splitting the query string and truncating the data. This tool offers both modes and defaults to component encoding.

The plus sign problem

In the application/x-www-form-urlencoded format used by HTML form submissions, a space is encoded as +, not %20. In the path portion of a URL, + is a literal plus. The same byte means two different things depending on where it appears. A literal plus in a query value must always be written as %2B, otherwise it will very likely be read as a space. This is a frequent source of corrupted email addresses containing tagged aliases.

Double encoding

Encoding an already-encoded string turns %20 into %2520, because the percent character itself gets escaped. This happens when a value is encoded by application code and then again by a framework or a redirect layer. The visible symptom is literal %20 text appearing on a page. The decoder here detects the pattern and tells you when input appears to be encoded more than once.

Reserved characters worth memorising

Inside a query parameter value, escape & as %26, = as %3D, ? as %3F, # as %23, + as %2B, / as %2F and space as %20. The fragment character # is especially damaging unescaped, because everything after it is never sent to the server at all.