URL Encoder/Decoder: Complete Guide to URL Encoding

What is URL Encoding and Why Is It Necessary

URL encoding (also known as percent-encoding) is a fundamental web mechanism that allows special characters to be transmitted within web addresses. When you enter a search query on Google, submit data through forms, or build REST API calls, special characters are automatically converted into safe sequences that can travel across the internet without causing parsing issues or misinterpretation.

Our URL Encoder/Decoder is a completely free tool that works 100% in your browser, without sending any data to external servers. It's perfect for developers, SEO specialists, system administrators, and anyone who works daily with URLs, web parameters, and RESTful APIs.

How Percent-Encoding Works (RFC 3986)

URLs (Uniform Resource Locators) can only contain a limited set of ASCII characters. According to the RFC 3986 specification, characters allowed in URLs are divided into:

• Unreserved characters: A-Z, a-z, 0-9, - _ . ~ (always safe)
• Reserved characters: : / ? # [ ] @ ! $ & ' ( ) * + , ; = (have special meaning)

All other characters (spaces, accented letters, emoji, symbols) must be encoded to be transmitted correctly through the HTTP protocol.

The Conversion Process

Percent-encoding converts each unsafe character into its hexadecimal UTF-8 value, preceded by the % symbol:

Character → UTF-8 Bytes → Percent-Encoded

Space     → 0x20      → %20
é         → 0xC3 0xA9 → %C3%A9
ñ         → 0xC3 0xB1 → %C3%B1
€         → 0xE2 0x82 0xAC → %E2%82%AC
😀        → 0xF0 0x9F 0x98 0x80 → %F0%9F%98%80

Common Characters Reference Table

Character	URL Encoding	Description	Typical Use
Space	%20 or +	Whitespace	Query strings
!	%21	Exclamation mark	Text, messages
#	%23	Hash/Pound	Fragment identifier
$	%24	Dollar sign	Prices, currencies
%	%25	Percent	Percentages, escape
&	%26	Ampersand	Parameter separator
'	%27	Apostrophe	Text content
+	%2B	Plus sign	Math operations
,	%2C	Comma	Lists, separators
/	%2F	Slash	URL path
:	%3A	Colon	Ports, protocols
=	%3D	Equals	Parameter assignment
?	%3F	Question mark	Query string start
@	%40	At sign	Email, credentials
中	%E4%B8%AD	Chinese character	Internationalization

7+ Real-World Use Cases with Examples

1. Search Engine Query Strings

When you search for "best coffee shop" on Google, the URL becomes:

https://www.google.com/search?q=best%20coffee%20shop

Without encoding, spaces would break the URL structure and cause parsing errors.

2. REST API Parameters

Modern APIs often require encoded parameters for complex filters:

GET /api/users?filter=name%3DJohn%26city%3DNew%20York%26age%3E30

// Decoded: filter=name=John&city=New York&age>30

3. Social Media Share Links

Share links include encoded URLs and text:

https://twitter.com/intent/tweet?url=https%3A%2F%2Fthejord.it%2Ftools&text=Great%20developer%20tools%21

// Decoded: url=https://thejord.it/tools&text=Great developer tools!

4. OAuth Redirect URIs

OAuth 2.0 authentication systems use encoded redirect_uri:

https://accounts.google.com/oauth2/auth
  ?client_id=xyz
  &redirect_uri=https%3A%2F%2Fmyapp.com%2Fauth%2Fcallback
  &scope=email%20profile
  &response_type=code

5. Form Data (application/x-www-form-urlencoded)

HTML forms submit data with URL encoding by default:

POST /contact HTTP/1.1
Content-Type: application/x-www-form-urlencoded

name=John+Doe&email=john%40example.com&message=Hello%2C+I%27d+like+more+info%21

6. Cookie Values

Cookie values containing JSON must be encoded:

Set-Cookie: user_prefs=%7B%22theme%22%3A%22dark%22%2C%22lang%22%3A%22en%22%7D

// Decoded: {"theme":"dark","lang":"en"}

7. Mobile App Deep Links

Deep links for iOS/Android use URL encoding for parameters:

myapp://product/view?name=Espresso%20Coffee&price=2.50&category=hot%20drinks

8. Webhook Payload URLs

Webhooks (Slack, Discord, etc.) require encoded URLs in payloads:

https://hooks.slack.com/services/xxx/yyy?text=Deploy%20completed%20%E2%9C%85%20to%20production

Code Examples in 5+ Languages

JavaScript (Browser and Node.js)

// encodeURIComponent - for parameter values (RECOMMENDED)
const encoded = encodeURIComponent('café italiano €5');
console.log(encoded); // caf%C3%A9%20italiano%20%E2%82%AC5

// decodeURIComponent - to decode
const decoded = decodeURIComponent(encoded);
console.log(decoded); // café italiano €5

// encodeURI - for complete URLs (does NOT encode : / ? # etc)
const url = encodeURI('https://example.com/path?q=café espresso');
console.log(url); // https://example.com/path?q=caf%C3%A9%20espresso

// URLSearchParams - for building query strings (MODERN)
const params = new URLSearchParams({
  name: 'John Doe',
  city: 'New York',
  email: 'john@example.com'
});
console.log(params.toString());
// name=John+Doe&city=New+York&email=john%40example.com

// URL API - for manipulating complete URLs
const myUrl = new URL('https://api.example.com/search');
myUrl.searchParams.set('query', 'café italiano');
myUrl.searchParams.set('limit', '10');
console.log(myUrl.href);
// https://api.example.com/search?query=caf%C3%A9+italiano&limit=10

Python

from urllib.parse import quote, unquote, urlencode, parse_qs

# quote - encode single string
encoded = quote('café italiano €5')
print(encoded)  # caf%C3%A9%20italiano%20%E2%82%AC5

# quote with custom safe chars
encoded_safe = quote('path/to/file', safe='/')
print(encoded_safe)  # path/to/file (slash not encoded)

# unquote - decode
decoded = unquote(encoded)
print(decoded)  # café italiano €5

# urlencode - for dictionaries (query strings)
params = urlencode({
    'name': 'John Doe',
    'city': 'New York',
    'price': '€5.00'
})
print(params)  # name=John+Doe&city=New+York&price=%E2%82%AC5.00

# parse_qs - parse query string
parsed = parse_qs('name=John&city=New+York')
print(parsed)  # {'name': ['John'], 'city': ['New York']}

PHP

<?php
// urlencode - encode (spaces as +)
$encoded = urlencode('café italiano €5');
echo $encoded; // caf%C3%A9+italiano+%E2%82%AC5

// rawurlencode - RFC 3986 encoding (spaces as %20)
$encoded_raw = rawurlencode('café italiano');
echo $encoded_raw; // caf%C3%A9%20italiano

// urldecode / rawurldecode - decode
$decoded = urldecode($encoded);
echo $decoded; // café italiano €5

// http_build_query - for associative arrays
$params = http_build_query([
    'name' => 'John Doe',
    'city' => 'New York',
    'tags' => ['php', 'web', 'api']
]);
echo $params;
// name=John+Doe&city=New+York&tags%5B0%5D=php&tags%5B1%5D=web&tags%5B2%5D=api

// parse_str - parse query string
parse_str('name=John&city=New+York', $result);
print_r($result); // Array ( [name] => John [city] => New York )
?>

Java

import java.net.URLEncoder;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;

// Encode
String encoded = URLEncoder.encode("café italiano €5", StandardCharsets.UTF_8);
System.out.println(encoded); // caf%C3%A9+italiano+%E2%82%AC5

// Decode
String decoded = URLDecoder.decode(encoded, StandardCharsets.UTF_8);
System.out.println(decoded); // café italiano €5

// With Java 11+ HttpClient
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;

String query = URLEncoder.encode("café", StandardCharsets.UTF_8);
URI uri = URI.create("https://api.example.com/search?q=" + query);
HttpRequest request = HttpRequest.newBuilder(uri).GET().build();

C# / .NET

using System;
using System.Web;
using System.Net;

// HttpUtility.UrlEncode (System.Web)
string encoded = HttpUtility.UrlEncode("café italiano €5");
Console.WriteLine(encoded); // caf%c3%a9+italiano+%e2%82%ac5

// Uri.EscapeDataString (RFC 3986 compliant)
string encoded2 = Uri.EscapeDataString("café italiano");
Console.WriteLine(encoded2); // caf%C3%A9%20italiano

// WebUtility.UrlEncode (.NET Core)
string encoded3 = WebUtility.UrlEncode("café italiano");
Console.WriteLine(encoded3); // caf%C3%A9+italiano

// Decode
string decoded = HttpUtility.UrlDecode(encoded);
Console.WriteLine(decoded); // café italiano €5

// QueryString builder
var query = HttpUtility.ParseQueryString(string.Empty);
query["name"] = "John Doe";
query["city"] = "New York";
Console.WriteLine(query.ToString()); // name=John+Doe&city=New+York

Go

package main

import (
    "fmt"
    "net/url"
)

func main() {
    // QueryEscape - encode
    encoded := url.QueryEscape("café italiano €5")
    fmt.Println(encoded) // caf%C3%A9+italiano+%E2%82%AC5

    // QueryUnescape - decode
    decoded, _ := url.QueryUnescape(encoded)
    fmt.Println(decoded) // café italiano €5

    // url.Values - build query string
    params := url.Values{}
    params.Add("name", "John Doe")
    params.Add("city", "New York")
    fmt.Println(params.Encode()) // city=New+York&name=John+Doe
}

Comparison: URL Encoding vs Other Encodings

Feature	URL Encoding	Base64	HTML Entities	JSON Escape
Primary purpose	Safe URLs	Binary → text	HTML characters	JSON strings
Output format	%XX	A-Za-z0-9+/=	&name; or {	\uXXXX
Average overhead	~3x for special	~1.33x always	~6x for special	~6x for special
Preserves readability	Partial	No	Yes	Partial
Standard	RFC 3986	RFC 4648	HTML5	RFC 8259
Binary support	No	Yes	No	No
Typical use case	Query strings	Inline images	Web pages	API responses

FAQ - Frequently Asked Questions

What's the difference between encodeURI and encodeURIComponent in JavaScript?

encodeURI() encodes a complete URL, leaving structural characters like :, /, ?, #, & intact. It's useful when you have a complete URL with special characters only in the path or query. encodeURIComponent() encodes everything except letters, numbers, and - _ . ~. Use encodeURIComponent() for parameter values, encodeURI() for pre-formed complete URLs.

Why does space become %20 or + ?

According to RFC 3986 (URI Generic Syntax), space should become %20. However, in the application/x-www-form-urlencoded format (used by HTML forms as defined in HTML5), space becomes + for historical compatibility. Both are valid but in different contexts. For safety, always use %20 in URLs and accept both when decoding.

How do I handle Unicode characters (emoji, Chinese, Arabic)?

Unicode characters are first converted to their UTF-8 representation (1-4 bytes), then each byte is percent-encoded. An emoji like 😀 (U+1F600) becomes %F0%9F%98%80 because it takes 4 bytes in UTF-8. A Chinese character like 中 (U+4E2D) becomes %E4%B8%AD (3 UTF-8 bytes).

Does URL encoding provide security?

Absolutely not. URL encoding is completely reversible and serves only to transmit special characters without corrupting URL structure. It provides no data protection whatsoever. To protect sensitive information, always use HTTPS, end-to-end encryption, and never include passwords or sensitive tokens in URLs.

Should I encode the entire URL or just the parameters?

Encode only the parameter values, never the entire URL structure. The structure (https://, /path/, ?, &, =) must remain intact to function. Correct example: ?name= + encodeURIComponent(value).

How do I avoid double encoding?

Double encoding happens when you encode already-encoded text: %20 becomes %2520. To avoid it: 1) Always decode before re-encoding, 2) Check if text contains %XX patterns before encoding, 3) Use functions that handle this case automatically. Double encoding can also indicate an attack attempt.

What's the maximum URL length?

There's no official limit in the specifications, but in practice: Internet Explorer supports up to 2083 characters, Chrome/Firefox/Safari about 65,000 characters, but many servers have lower limits (8KB typical for Apache/Nginx). For large data, use POST instead of GET.

How do I test if my URL is correctly encoded?

Use our URL Encoder/Decoder to verify. Paste the URL, decode it, and check if the result is the original text. A well-formed URL should: 1) Not contain spaces (only %20 or +), 2) Not contain visible non-ASCII characters, 3) Decode without errors.

Security Best Practices

✅ Do

• Always encode user input before inserting it into URLs to prevent injection
• Use standard libraries from your language - avoid custom implementations
• Validate URLs after decoding to prevent path traversal attacks
• Use HTTPS to protect data in transit (URLs are visible in logs)
• Limit URL length accepted to prevent DoS attacks
• Sanitize decoded paths before accessing the filesystem

❌ Don't

• Never trust decoded URLs without validation - they can contain malicious payloads
• Don't build URLs by concatenating strings without encoding values
• Don't assume encoding prevents XSS or SQL injection - it's only for transport
• Never put passwords, tokens, or sensitive data in URLs - they're logged everywhere
• Don't ignore double encoding - it may indicate a bypass attempt

Secure Code Example

// ❌ DANGEROUS - URL injection possible
const url = `https://api.com/user?id=${userId}&name=${userName}`;

// ✅ SAFE - always encode user values
const url = `https://api.com/user?id=${encodeURIComponent(userId)}&name=${encodeURIComponent(userName)}`;

// ✅ EVEN BETTER - validate first, then encode
function buildUserUrl(userId, userName) {
  // Validation
  if (!/^[a-zA-Z0-9_-]+$/.test(userId)) {
    throw new Error('Invalid userId');
  }
  if (userName.length > 100) {
    throw new Error('userName too long');
  }

  // Safe construction
  const params = new URLSearchParams({ id: userId, name: userName });
  return `https://api.com/user?${params}`;
}

Related Tools on THEJORD

Discover other useful tools for developers and web professionals:

• Base64 Encoder/Decoder - Encode and decode binary data to safe ASCII format
• JSON Formatter - Format, validate, and minify JSON data with syntax highlighting
• Hash Generator - Generate MD5, SHA-1, SHA-256, SHA-512 hashes for integrity verification
• RegEx Tester - Test and debug regular expressions in real-time
• Diff Checker - Compare two texts and find the differences

Authoritative External Resources

• RFC 3986 - URI Generic Syntax - Official IETF specification
• MDN - encodeURIComponent() - JavaScript documentation
• Wikipedia - Percent-encoding - General overview

🔗 Try our free URL Encoder/Decoder →