URL Encoder & Decoder

What Is URL Encoding?

URL encoding (also called percent-encoding) converts characters that are not allowed in URLs into a safe format using a percent sign followed by two hexadecimal digits. Space becomes %20 or +, & becomes %26, = becomes %3D, and so on. This allows URLs to safely carry text containing special characters.

Why URL Encoding Is Necessary

URLs can only contain a limited set of characters from the ASCII standard. Characters outside this set — including spaces, non-English letters, and many punctuation marks — must be encoded to be safely transmitted over the internet. Without encoding, a URL containing "hello world" would break because the space is ambiguous.

URL Encoding vs Full URL Encoding

encodeURIComponent() encodes everything except letters, digits, and - _ . ! ~ * ' ( ) — designed for encoding individual parameter values. encodeURI() leaves the URI structure intact, encoding spaces and non-ASCII but preserving : / ? # & = + @ — designed for encoding a full URL. Use encodeURIComponent for parameter values, encodeURI for complete URLs.

Why URLs Need Encoding

URLs are built on a character set defined in RFC 3986 — only unreserved characters (letters, digits, hyphen, period, underscore, tilde) may appear unencoded. All other characters, including spaces, special characters, and non-ASCII Unicode, must be percent-encoded: replaced with % followed by two hexadecimal digits representing the character's byte value in UTF-8 encoding. A space becomes %20. An ampersand becomes %26. The at-sign becomes %40. This encoding ensures that URLs can be transmitted through internet infrastructure that may misinterpret special characters as structural URL components.

URL Encoding in Web Development

Web developers encounter URL encoding constantly. Query string parameters (the part after ? in a URL) require encoding of all special characters: a search query 'hello world' becomes 'hello+world' or 'hello%20world' depending on whether form encoding or URI encoding is used. API endpoints receiving text data must handle both encoded and unencoded inputs gracefully. Form submissions encode all field values before transmission. Understanding the difference between encodeURIComponent() (encodes everything except URI unreserved characters) and encodeURI() (preserves URI structure characters like /, ?, #, =) is essential JavaScript knowledge.

Internationalized Domain Names

Domain names were originally restricted to ASCII characters (letters, digits, hyphens). Internationalized Domain Names (IDN) allow non-ASCII characters through Punycode encoding: the Chinese domain 中文.com becomes xn--fiq228c.com in the DNS system. This encoding preserves the internationalized name for display while ensuring compatibility with DNS infrastructure built for ASCII. URL encoding tools that handle Unicode input are increasingly important as internationalized domains become more common in global web content.

URL Encoding Security Implications

URL encoding has important security implications that developers must understand. Double-encoding attacks involve encoding an already-encoded string, creating inputs that bypass single-pass validation. Unicode encoding attacks substitute Unicode lookalike characters that normalize to different characters on decoding. Path traversal attacks use encoded slash characters (%2F) or encoded dots (%2E%2E) to construct paths that bypass directory restriction checks. Security-conscious web development includes proper encoding/decoding at every layer that handles URL components.

Practical URL Encoding Applications

Beyond web development, URL encoding has practical everyday applications. Creating shareable links that contain search queries, custom parameters, or non-English text requires proper encoding to ensure the link works across different systems. Email marketing tools need properly encoded tracking parameters. Social media management tools encode special characters in scheduled post URLs. API integration work often requires manual URL construction where proper encoding of each parameter is essential. This tool enables quick encoding and decoding without writing code.

How URLs Work Technically

A URL (Uniform Resource Locator) consists of specific components: scheme (https://), authority (domain + optional port), path (/page/subpage/), query string (?key=value&key2=value2), and fragment (#section). The query string is where URL encoding most frequently matters: values in query strings must be encoded because the characters used as delimiters (& = ? #) must be distinguishable from the same characters appearing in the values themselves. URL encoding replaces special characters with percent signs followed by their hexadecimal ASCII codes.

Percent Encoding Rules

RFC 3986 defines which characters must be percent-encoded in URLs. Unreserved characters (A-Z, a-z, 0-9, -, _, ., ~) never need encoding. Reserved characters (; / ? : @ & = + $ , # [ ]) have special meanings in URL structure and must be encoded when appearing in values. Everything else must also be encoded. Space becomes %20 (or + in form data encoding). The at sign @ becomes %40 when in an email address used as a URL parameter. The number sign # becomes %23 when it's part of a value rather than a fragment identifier.

URL Encoding in API Development

API developers encounter URL encoding constantly. REST API endpoints frequently include user-provided values in URLs — a search query like 'New York & California' must be encoded to 'New%20York%20%26%20California' before being appended to an API endpoint URL. Incorrectly encoding (or double-encoding) API parameters is one of the most common causes of '400 Bad Request' errors in web development. The URL encoder tool provides a quick sanity check for API URLs before sending requests.

Form Submission and application/x-www-form-urlencoded

HTML forms submitting via HTTP POST use application/x-www-form-urlencoded content type — a URL encoding variant where spaces become + rather than %20 and special characters are percent-encoded. This encoding is one of the oldest web standards, dating to the original HTML specification. While modern APIs increasingly use JSON encoding instead, HTML form submission still uses URL encoding as the default, making understanding URL encoding relevant for web developers working with any HTML form that submits to a server.

URL Shorteners and Encoding

URL shorteners (bit.ly, tinyurl, etc.) receive a full URL and return a short redirect URL. The full URL passed to a shortener must itself be properly URL-encoded if it contains special characters — otherwise the shortener may misparse the target URL. Social media platforms that process embedded URLs in posts similarly require properly encoded URLs. A URL with unencoded special characters that appears to work in a browser (which often handles encoding automatically) may fail when processed programmatically by social media scrapers and URL validators.

URL Encoding in Analytics

URL encoding is essential for maintaining accurate web analytics. UTM parameters — the tracking codes appended to URLs in marketing campaigns (utm_source, utm_medium, utm_campaign) — require proper URL encoding of any special characters in their values. A campaign named 'Black Friday 2025' as a UTM value must become 'Black+Friday+2025' or 'Black%20Friday%202025'. Improperly encoded UTM parameters cause analytics tools to misparse tracking data, leading to incomplete or incorrect campaign attribution that undermines marketing measurement efforts.