URL Encoder & Decoder

RFC 3986 Percent-Encoding Specifications

Uniform Resource Identifiers (URIs) and URLs are constrained by RFC 3986 to a restricted subset of the US-ASCII character set. Characters that are not within this restricted set, or that possess special reserved syntactical meaning in URL structure (such as delimiters /, ?, &, =, #), must be represented via Percent-Encoding (URL encoding).

A percent-encoded character consists of a percent sign (%) followed by a two-character hexadecimal number representing the character's numerical byte value in UTF-8. For example, a space character (ASCII 32, hex 20) becomes %20, and an ampersand becomes %26.

Our URL Encoder & Decoder provides instant bidirectional conversion, supporting both full URI encoding and individual query parameter component encoding.

encodeURI() vs encodeURIComponent() in JavaScript

A critical distinction in web development is choosing between the two native JavaScript URL encoding functions:

• encodeURI(): Designed for encoding complete, entire URLs. It leaves protocol and routing delimiters intact (http://, /, ?, &, #) while encoding non-ASCII characters and spaces.
• encodeURIComponent(): Designed for encoding individual parameter keys and values. It encodes ALL reserved characters (including &, =, /, and ?). Always use encodeURIComponent() when adding values to query parameters to prevent query injection bugs.

const query = "shoes & socks = cool";

// WRONG: Corrupts query string parameters
const badUrl = "https://example.com/search?q=" + encodeURI(query);
// Result: https://example.com/search?q=shoes%20&%20socks%20=%20cool (& creates new param!)

// CORRECT: Safely escapes parameter delimiters
const goodUrl = "https://example.com/search?q=" + encodeURIComponent(query);
// Result: https://example.com/search?q=shoes%20%26%20socks%20%3D%20cool

Programmatic URL Encoding in Python & CLI

# Python 3 urllib.parse
from urllib.parse import quote, unquote

param = "search term & filter"
encoded = quote(param)
print("Encoded:", encoded) # search%20term%20%26%20filter
print("Decoded:", unquote(encoded))

The Plus (+) vs %20 Space Controversy

In standard RFC 3986 URI paths, a space must strictly be encoded as %20. However, in legacy HTML form submissions (MIME type application/x-www-form-urlencoded), spaces are encoded as plus signs (+). Modern web servers automatically decode both, but %20 is preferred for REST API compliance.

RFC 3986 Percent-Encoding vs application/x-www-form-urlencoded

Uniform Resource Identifiers (URIs) divide characters into two functional categories: Reserved Characters (such as : / ? # [ ] @ ! $ & ' ( ) * + , ; =) that dictate URI structure, and Unreserved Characters (alphanumerics, hyphen, period, underscore, tilde) that carry literal payloads. When arbitrary data contains reserved or non-ASCII characters, it must undergo percent-encoding.

A crucial technical distinction exists between standard RFC 3986 percent-encoding (where spaces become %20) and HTML form submission encoding application/x-www-form-urlencoded (where spaces become +). Confusing these standards in OAuth authorization strings or API endpoints triggers signature validation failures and 400 Bad Request errors.

Handling OAuth Redirect URIs & Deep Linking Encoding Constraints

In OAuth 2.0 and OpenID Connect authorization flows, the redirect_uri parameter frequently contains nested query parameters for state tracking and deep linking. If this redirect URL is not strictly percent-encoded using encodeURIComponent(), identity providers will truncate the parameter at the first unencoded ampersand (&), causing authentication redirects to fail with invalid callback errors.

Frequently Asked Questions