URL Encoder and Decoder

What Is URL Encoding?

URL encoding (also called percent-encoding) is a mechanism defined by RFC 3986 to represent characters in a Uniform Resource Identifier (URI) that are not allowed or have special meaning. Since URLs can only contain a limited subset of ASCII characters, any character outside this safe set must be encoded as a percent sign followed by two hexadecimal digits — for example, a space becomes %20. URL encoding ensures data is transmitted accurately across all web browsers, servers, and intermediary systems without being misinterpreted.

Why URL Encoding Is Needed

URLs follow strict rules about which characters are allowed. Without encoding:

• Spaces break URLs: A browser cannot process https://example.com/my file.pdf — the space terminates the URL.
• Reserved characters cause ambiguity: Characters like ?, &, =, #, and / have special structural meaning in URLs. Using them in data (query values, paths) confuses parsers.
• Non-ASCII characters are not supported: International characters (漢字, ñ, ü) must be UTF-8 encoded first, then percent-encoded.
• Standards compliance: RFC 3986 requires encoding to ensure URIs are interoperable across all systems and platforms.

URL Character Categories

Two Encoding Methods: urlencode vs rawurlencode

There are two common approaches to URL encoding, and choosing the wrong one can cause subtle bugs:

Rule of thumb: Use RFC 3986 encoding (%20 for spaces) for building URLs. Use form encoding (+ for spaces) only when submitting HTML form data.

Common Encoding Examples

URL Encoding in Different Languages

• JavaScript: encodeURIComponent(string) for data, encodeURI(url) for full URLs (preserves structural characters)
• Python: urllib.parse.quote(string) (RFC 3986) or urllib.parse.quote_plus(string) (form encoding)
• PHP: rawurlencode($string) (RFC 3986) or urlencode($string) (form encoding)
• Java: URLEncoder.encode(string, "UTF-8") (form encoding — replace + with %20 for RFC 3986)
• C# / .NET: Uri.EscapeDataString(string)

Common Mistakes to Avoid

• Double encoding: Encoding an already-encoded string turns %20 into %2520. Always decode first if unsure, then encode once.
• Using encodeURI for data: encodeURI() in JavaScript does not encode reserved characters like &, =, ?. Use encodeURIComponent() for query parameter values.
• Forgetting to encode: Passing user input directly into URLs without encoding creates broken links and potential security vulnerabilities (open redirects, injection).
• Encoding the entire URL: Only encode the data parts (query values, path segments). Do not encode the protocol (https://), domain, or structural delimiters.

Use Cases

• Form submissions: Browsers automatically URL-encode form data using application/x-www-form-urlencoded content type.
• Query parameters: When building URLs dynamically, encode each parameter value: ?search=hello%20world&lang=en
• REST APIs: Encode path parameters and query values. Many HTTP libraries handle this automatically, but manual encoding is needed for string concatenation.
• Redirect URLs: When passing a callback URL as a parameter, it must be encoded: ?redirect=https%3A%2F%2Fexample.com%2Fpage
• Email mailto links: Subject and body parameters in mailto links must be encoded: mailto:user@example.com?subject=Hello%20World