URL Encode Decode Tool
Encode special characters for URLs or decode percent-encoded URL strings. Enter values for instant results with step-by-step formulas.
Reviewed for accuracy by Daniel Agrici, Founder & Lead Developer
Formula
Character -> UTF-8 bytes -> %XX per byte
URL encoding converts each unsafe character to its UTF-8 byte representation, then represents each byte as a percent sign followed by two hexadecimal digits. For example, a space (byte 0x20) becomes %20, and a multi-byte Unicode character produces multiple %XX sequences.
Worked Examples
Example 1: Encoding a URL with Query Parameters
Problem:Encode the URL: https://example.com/search?q=hello world&category=books & media
Solution:Using encodeURI (preserve URL structure): https://example.com/search?q=hello%20world&category=books%20&%20media Note: & is preserved as URL delimiter Using encodeURIComponent (for parameter values only): q = hello%20world category = books%20%26%20media Note: & in 'books & media' is encoded to %26 Full reconstructed URL: https://example.com/search?q=hello%20world&category=books%20%26%20media
Result:Space -> %20 | & in value -> %26 | URL structure preserved correctly
Example 2: Decoding a Complex Percent-Encoded URL
Problem:Decode: https://api.example.com/v2/users?name=Fran%C3%A7ois%20M%C3%BCller&city=Z%C3%BCrich
Solution:Percent-encoded sequences: %C3%A7 -> UTF-8 bytes C3 A7 -> Unicode U+00E7 -> character: c with cedilla %20 -> space %C3%BC -> UTF-8 bytes C3 BC -> Unicode U+00FC -> character: u with umlaut Decoded parameters: name = Francois Muller (with proper diacritics) city = Zurich (with u-umlaut) Full decoded URL: https://api.example.com/v2/users?name=Francois Muller&city=Zurich
Result:Decoded: name=Francois Muller, city=Zurich | 3 Unicode chars decoded
Frequently Asked Questions
What is URL encoding and why is it necessary?
URL encoding, also called percent-encoding, is the process of converting characters that are not allowed or have special meaning in URLs into a safe format using percent signs followed by hexadecimal values. URLs can only contain a limited set of characters from the ASCII character set, and certain characters like spaces, ampersands, question marks, and hash symbols have reserved meanings as delimiters within the URL structure. Without encoding, a search query containing an ampersand would be misinterpreted as a parameter separator, breaking the URL parsing. For example, a space becomes %20, an ampersand becomes %26, and a question mark becomes %3F. This ensures that user input and data values are transmitted correctly without interfering with the URL structure itself.
What is the difference between encodeURI and encodeURIComponent?
These two JavaScript functions serve different purposes and encode different sets of characters. encodeURI is designed to encode a complete URL while preserving its structure, so it does NOT encode reserved URL characters like colon, forward slash, question mark, hash, ampersand, equals, plus, and at sign. This means encodeURI('https://example.com/path?q=test') keeps the URL structure intact. encodeURIComponent is designed to encode a single URL component like a query parameter value, so it DOES encode all reserved characters including colon, slash, question mark, and ampersand. Use encodeURIComponent when encoding individual parameter values to prevent them from being interpreted as URL delimiters. Using the wrong function is a common source of bugs in web applications.
What characters are safe in URLs without encoding?
The RFC 3986 specification defines unreserved characters that never need encoding in URLs. These are uppercase letters A through Z, lowercase letters a through z, digits 0 through 9, and four special characters: hyphen (-), period (.), underscore (_), and tilde (~). These 66 characters can appear anywhere in a URL without percent-encoding. Reserved characters that have special URL meanings include colon, slash, question mark, hash, square brackets, at sign, exclamation, dollar, ampersand, single quote, parentheses, asterisk, plus, comma, semicolon, and equals. Whether reserved characters need encoding depends on context. A slash in the path component is structural and should not be encoded, but a slash in a query parameter value must be encoded as %2F to avoid being interpreted as a path separator.
How does percent-encoding handle Unicode and international characters?
Unicode characters are encoded in URLs through a two-step process defined in RFC 3986. First, the character is converted to its UTF-8 byte representation, which may be one to four bytes depending on the character. Then each byte is percent-encoded independently. For example, the Euro sign has the Unicode code point U+20AC, which in UTF-8 is three bytes: E2 82 AC. These become %E2%82%AC in the URL. Chinese, Arabic, Japanese, and other non-Latin scripts follow the same process with their respective UTF-8 representations. Modern browsers handle this transparently in the address bar, showing the readable characters while sending the encoded version to the server. This system called Internationalized Resource Identifiers (IRIs) allows URLs to contain text in any language.
What are common mistakes when working with URL encoding?
The most frequent mistake is double-encoding, where an already-encoded string gets encoded again, turning %20 into %2520 (the percent sign itself gets encoded). This happens when code applies encoding without checking if the string is already encoded. Another common error is using encodeURI when encodeURIComponent is needed, which fails to encode ampersands and equals signs in query values, breaking parameter parsing. Forgetting to encode plus signs in query strings is problematic because HTML forms encode spaces as plus signs per the application/x-www-form-urlencoded specification, but this is different from standard percent-encoding where spaces are %20. Developers also frequently forget to decode URL parameters on the server side, storing encoded data in databases. Using manual string replacement instead of proper encoding functions leads to missed edge cases.
How do spaces get encoded in URLs and why are there two methods?
Spaces in URLs can be represented as either %20 (percent-encoding per RFC 3986) or as a plus sign (+) (per the HTML form specification). The plus-sign convention dates back to early HTML forms that used the application/x-www-form-urlencoded content type, where spaces in form data are replaced with plus signs for compactness. The %20 encoding is the standard defined in RFC 3986 for general URI use. In query strings, both formats are widely accepted by web servers and frameworks. However, in the path portion of a URL, only %20 is correct and a literal plus sign means an actual plus character. JavaScript encodeURIComponent encodes spaces as %20, while the older escape function and HTML form submissions use the plus sign convention. When in doubt, use %20 as it is universally supported and unambiguous.
What is the application/x-www-form-urlencoded content type?
This content type is the default encoding method for HTML form submissions and has specific rules that differ from standard URL percent-encoding. When a browser submits a form with method POST, it encodes the form data so that spaces become plus signs (not %20), and all non-alphanumeric characters except hyphen, underscore, period, and asterisk are percent-encoded. Key-value pairs from form fields are joined with ampersands, and keys are separated from values with equals signs. This format is also used in query strings of GET requests from forms. While similar to percent-encoding, the space-as-plus convention and different sets of reserved characters make it a distinct format. Server frameworks like Express, Django, and Rails automatically parse this format when handling form submissions, but understanding the format is important for debugging and API integration.
How do different programming languages handle URL encoding?
Each programming language provides its own URL encoding functions with subtle differences. JavaScript offers encodeURIComponent for component encoding and encodeURI for full URLs. Python has urllib.parse.quote for percent-encoding and urllib.parse.urlencode for form data encoding. PHP provides urlencode (which encodes spaces as plus signs) and rawurlencode (which uses %20 for spaces per RFC 3986). Java offers URLEncoder.encode which follows form encoding conventions with spaces as plus signs. Ruby uses ERB::Util.url_encode and CGI.escape with different behaviors for reserved characters. These differences can cause interoperability issues when systems written in different languages communicate, making it important to explicitly choose between RFC 3986 percent-encoding and form-data encoding based on your specific use case.
Can URL encoding cause security vulnerabilities?
Yes, improper URL encoding and decoding is the root cause of several web security vulnerabilities. Path traversal attacks use encoded sequences like %2e%2e%2f (which decodes to ../) to escape intended directory structures and access unauthorized files on the server. Double encoding attacks exploit applications that decode URLs multiple times, where %252e%252e%252f first decodes to %2e%2e%2f and then to ../, bypassing security filters that only check for the decoded form. Cross-site scripting (XSS) attacks can use URL encoding to smuggle malicious JavaScript through input validation that does not properly decode before checking. SQL injection payloads can be URL-encoded to bypass web application firewalls. The defense involves properly decoding all input before validation, using parameterized queries, and implementing allowlist-based input validation rather than blocklist approaches.
What is the maximum length of a URL and how does encoding affect it?
While the HTTP specification does not define a maximum URL length, practical limits exist across browsers and servers. Internet Explorer historically limited URLs to 2,083 characters, and while modern browsers support much longer URLs (Chrome and Firefox handle over 60,000 characters), many web servers and proxies enforce limits between 2,048 and 8,192 characters. URL encoding significantly impacts effective URL length because each encoded character expands from 1 character to 3 characters (%XX format), and multi-byte Unicode characters can expand to 9 or more characters. A Chinese character that is 3 UTF-8 bytes becomes 9 characters when percent-encoded (%E4%B8%AD). This means a query string with internationalized content can quickly exceed URL length limits. For large data payloads, POST requests with the data in the request body are preferred over GET requests with encoded query parameters.
References
Background & Theory
History
Reviewed for accuracy by Daniel Agrici, Founder & Lead Developer · Editorial policy
Related Calculators
🧮Base64 Encoder Decoder
Calculate base64 encoder decoder with inputs, formulas, and instant results.
🧮Base64 Encode Decode Tool
Encode text to Base64 or decode Base64 strings back to plain text instantly.
🧮Html Entity Encoder
Calculate html entity encoder with inputs, formulas, and instant results.
🧮Base64encode Decode Calculator
Calculate base64encode decode with inputs, formulas, and instant results.
🧮Jwt Decoder
jwt decoder. Get instant, accurate results.
🧮Bandwidth Time Transfer Calculator
Calculate bandwidth time transfer with inputs, formulas, and instant results.
🧮Download Time Calculator
Calculate download time with inputs, formulas, and instant results.
🧮Throughput Efficiency Calculator
Calculate throughput efficiency with inputs, formulas, and instant results.