54+ Local Tools Available
100% Browser Execution (No Uploads)
Zero Latency Instant Output
100% Private & Secure
Developer & Data Client Local

Url Encoder Decoder

Client-side Url Encoder Decoder tool running 100% in browser.

Quick Sample Templates:
0 chars0 bytesSize Change: -
Conversion Result (Result)
URL output will appear here...

Encoding & Standard Options (Options)

Recent Conversion History

No recent conversions found.

URL Encoding Essentials

Percent-Encoding: Converts non-ASCII UTF-8 bytes and reserved URL characters into % followed by 2 hexadecimal digits (%HH).

encodeURI vs encodeURIComponent: Use encodeURI to preserve overall URL structure (http://, ?, &) and encodeURIComponent when encoding individual query parameter values.

Space Characters ( ): %20 is the standard for generic URIs, while + is used in HTML form (application/x-www-form-urlencoded) query data.

Input authentication tokens, password query parameters, and private URLs are never transmitted to an external server. All operations run within your local browser JavaScript engine.

Web Standards & HTTP Protocol Specification

Architectural Principles of URL Percent-Encoding & RFC 3986 Standards

A Uniform Resource Locator (URL) is a standardized identifier pointing to network resources. Originally defined for 7-bit US-ASCII character subsets, embedding multi-byte Unicode characters (East Asian scripts, emojis, accents) or raw control characters directly into URLs causes parser errors in network proxies and web servers.

Percent-encoding (URL encoding) solves this by replacing reserved characters and non-ASCII UTF-8 bytes with a % sign followed by a 2-digit hexadecimal byte value according to W3C and IETF RFC 3986 standards.

This guide explores the RFC 3986 reserved vs. unreserved taxonomy, the structural differences between encodeURI and encodeURIComponent, UTF-8 multi-byte percent mathematics, language-specific code snippets, and web security anti-patterns.

RFC 3986 Strict Compliance Mode

Encodes exclamation points (!), single quotes ('), parentheses (), and asterisks (*) into %21, %27, %28, %29, and %2A for strict OAuth 1.0/2.0 signatures.

Dual Mode: encodeURI vs encodeURIComponent

Easily switch between preserving overall URL addressing and fully escaping query parameter keys and values.

Space Formatting: %20 vs + Support

Toggle between standard RFC 3986 URI (%20) and legacy HTML form query parameter (+) space encoding.

Local Conversion History Tracking

Maintains a private local history of recent URL conversions with one-click reload capabilities.

1. RFC 3986 URL Character Classification (Reserved vs. Unreserved)

① Unreserved Characters (Safe Characters - Never Encoded):
- Uppercase letters (A-Z), lowercase letters (a-z), digits (0-9), hyphen (-), underscore (_), period (.), and tilde (~) (66 characters total).
② Reserved Characters (Structural Delimiters):
- Generic Delimiters (Gen-delims): :, /, ?, #, [, ], @ (separates schemes, hosts, paths, queries, and fragments).
- Sub-delimiters (Sub-delims): !, $, &, ', (, ), *, +, ,, ;, = (parameter key-value separators).
③ Mandatory Encoded Characters:
- Spaces ( ), line breaks (\n), control codes (ASCII 0-31 and 127), and all non-ASCII UTF-8 multi-byte characters (code points ≥128\ge 128).

2. JavaScript Built-in Functions URL Character Encoding Comparison Table

Comparison of character sets preserved and escaped across standard encoding functions.

Character SetRepresentative ExamplesencodeURI()encodeURIComponent()RFC 3986 Strict
AlphanumericA-Z, a-z, 0-9Preserved (Raw)Preserved (Raw)Preserved (Raw)
Unreserved Symbols- _ . ~Preserved (Raw)Preserved (Raw)Preserved (Raw)
URL Structural Delimiters: / ? # [ ] @Preserved (Maintains URL)Encoded (%3A %2F %3F %23)Encoded (%3A %2F %3F %23)
Query Sub-delimiters& = + $ , ;Preserved (Separators)Encoded (%26 %3D %2B %24)Encoded (%26 %3D %2B %24)
Special Symbols (RFC 3986)! ' ( ) *Preserved (Raw)Preserved (Raw JS omission)Strictly Encoded (%21 %27 %28 %29 %2A)
Unicode & Non-ASCIIAsian scripts, 🚀, AccentsUTF-8 %HH Byte EncodedUTF-8 %HH Byte EncodedUTF-8 %HH Byte Encoded

3. Mathematical Mechanics of UTF-8 3-Byte Percent-Encoding

① Unicode Code Point Chunking (e.g. Unicode '가' →\to %EA%B0%80):
- The Unicode code point for '가' is U+AC00 (binary 1010 1100 0000 0000 / 16 bits).
- Following the UTF-8 3-byte template 1110xxxx 10xxxxxx 10xxxxxx, the 16 bits are distributed into 3 bytes:
- Byte 1: 1110 + 1010 = 11101010 = hex 0xEA →\to %EA
- Byte 2: 10 + 110000 = 10110000 = hex 0xB0 →\to %B0
- Byte 3: 10 + 000000 = 10000000 = hex 0x80 →\to %80
- Result: Each 3-byte Unicode character expands into 9 characters (%EA%B0%80) for network transmission.

4. Web Security Considerations & Anti-Patterns

① Preventing Double Encoding Vulnerabilities:
- Re-encoding an already-encoded string (%2520) encodes the % symbol into %252520.
- Discrepancies in decoding counts between Web Application Firewalls (WAFs) and application servers can allow Path Traversal bypasses. Always encode exactly once right before transmission.
② Preventing Open Redirect Vulnerabilities:
- When processing redirect parameters (redirect=https://evil.com), always validate the decoded destination against a strict domain whitelist before initiating the redirect.

Developer Implementation Snippets for URL Encoding & Decoding

Production code examples across JavaScript/TypeScript, Python, Java, Go, PHP, and C#.

JavaScript / TypeScript
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
// 1. RFC 3986 Strict Parameter Encoding
function encodeRFC3986(str: string): string {
return encodeURIComponent(str).replace(
/[!'()*]/g,
(c) => '%' + c.charCodeAt(0).toString(16).toUpperCase()
);
}
 
const param = "Hello World & Next.js (2026)";
const encoded = encodeRFC3986(param);
console.log("Encoded:", encoded);
 
// 2. URL Decoding
const decoded = decodeURIComponent(encoded);
console.log("Decoded:", decoded);
Python 3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
import urllib.parse
 
query = "Hello World & Next.js"
 
# 1. RFC 3986 Standard (%20 spaces)
encoded_rfc = urllib.parse.quote(query, safe='')
print("RFC 3986:", encoded_rfc)
 
# 2. Form Data Query (+ spaces)
encoded_plus = urllib.parse.quote_plus(query)
print("Form Query:", encoded_plus)
 
# 3. Decoding
decoded = urllib.parse.unquote(encoded_rfc)
print("Decoded:", decoded)
Java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
import java.net.URLEncoder;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
 
public class UrlCodec {
public static void main(String[] args) {
String text = "Hello World & Next.js";
// Java URLEncoder converts spaces to +, so replace with %20 for RFC 3986
String encoded = URLEncoder.encode(text, StandardCharsets.UTF_8)
.replace("+", "%20");
System.out.println("Encoded: " + encoded);
String decoded = URLDecoder.decode(encoded, StandardCharsets.UTF_8);
System.out.println("Decoded: " + decoded);
}
}
Go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
package main
 
import (
"fmt"
"net/url"
)
 
func main() {
query := "Hello World & Next.js"
 
// 1. QueryEscape (+ spaces)
escaped := url.QueryEscape(query)
fmt.Println("QueryEscape:", escaped)
 
// 2. PathEscape (%20 spaces)
pathEscaped := url.PathEscape(query)
fmt.Println("PathEscape:", pathEscaped)
 
// 3. Decoding
decoded, _ := url.QueryUnescape(escaped)
fmt.Println("Decoded:", decoded)
}
PHP
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<?php
$text = "Hello World & Next.js";
 
// 1. rawurlencode (RFC 3986 %20)
$encoded = rawurlencode($text);
echo "RFC 3986: " . $encoded . "\n";
 
// 2. urlencode (+ spaces)
$formEncoded = urlencode($text);
echo "Form Encoded: " . $formEncoded . "\n";
 
// 3. Decoding
$decoded = rawurldecode($encoded);
echo "Decoded: " . $decoded . "\n";
?>
C# / .NET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
using System;
 
class Program {
static void Main() {
string text = "Hello World & Next.js";
// 1. Uri.EscapeDataString (RFC 3986 %20)
string encoded = Uri.EscapeDataString(text);
Console.WriteLine($"Encoded: {encoded}");
// 2. Decoding
string decoded = Uri.UnescapeDataString(encoded);
Console.WriteLine($"Decoded: {decoded}");
}
}

Client-Side Local Processing FAQ

Q.How does URL encoding differ from HTML entity encoding?

URL percent-encoding formats characters into %20, %26, %3F for safe transmission across HTTP network request lines and headers. HTML entity encoding converts characters into &amp;, &lt;, &gt; to prevent XSS and tag parsing errors inside web browser DOM documents.

Q.When should I use encodeURI() vs encodeURIComponent()?

Use encodeURI() when processing complete URL addresses (https://example.com/search?q=test) to preserve protocols and path slashes. Use encodeURIComponent() when encoding individual query parameter values to ensure delimiters (?, &, =) do not break parameter boundaries.

Q.Why do spaces encode as %20 in some places and + in others?

IETF RFC 3986 specifies %20 for standard URIs, while W3C HTML form specifications (application/x-www-form-urlencoded) define + for form query strings.

Q.Why does a single Asian character expand to 9 characters (%XX%XX%XX)?

In UTF-8, Asian ideographs occupy 3 bytes (24 bits). Percent-encoding converts each 8-bit byte into 3 characters (% + 2 hex digits), expanding 1 character into 9 characters.

Q.What is RFC 3986 Strict Encoding?

Standard JavaScript encodeURIComponent() leaves !, ', (, ), * unencoded for historical reasons. RFC 3986 Strict explicitly encodes them into %21, %27, %28, %29, and %2A, which is required by OAuth signatures and strict API gateways.

Q.Why do I see a "URI malformed" error during decoding?

This occurs when a % sign is not followed by two valid hexadecimal characters (e.g. %G1) or when a multi-byte UTF-8 sequence is incomplete.

Q.Is my URL input sent to any remote server?

No. All encoding and decoding run locally in your browser memory, with no network uploads.

Q.Can URL encoding be used for data encryption?

No. URL encoding is a public, reversible data transport standard (Encoding), not cryptographic encryption. Anyone can decode it instantly without a key.