URL Encoder & Decoder

RFC 3986 URI Architecture: Reserved vs. Unreserved Characters

The Uniform Resource Identifier (URI) specification (RFC 3986) establishes an unambiguous syntax for identifying resources across network protocols. Because URIs must traverse heterogeneous transport systems—including legacy routers, email gateways, and HTTP proxies—only a restricted subset of the US-ASCII character set is permitted directly within a URI string.

Characters are strictly partitioned into two primary classes:

Classification	Character Set	RFC 3986 Section	Syntactic Function
Unreserved	A-Z a-z 0-9 - _ . ~	Section 2.3	Characters that never have a syntactic delimiter role and must never be encoded.
Generic Delimiters (gen-delims)	: / ? # [ ] @	Section 2.2	Delimit major URI components (scheme, authority, path, query, fragment).
Sub-delimiters (sub-delims)	! $ & ' ( ) * + , ; =	Section 2.2	Delimit subcomponents within components, such as query string key-value pairs.

A reserved character is allowed in raw form only when serving as a delimiter between syntactic components. When a reserved character occurs as part of the data within a component (such as an ampersand inside a query value), it must be percent-encoded to prevent parsers from treating it as a delimiter.

Percent-Encoding Mechanics & UTF-8 Multibyte Serialization

Percent-encoding represents arbitrary octets using a three-character sequence: a percent sign (%) followed by two hexadecimal digits denoting the byte value. When encoding characters outside the 7-bit US-ASCII range (code points greater than U+007F), RFC 3986 Section 2.5 mandates a two-stage process:

UTF-8 Byte Transformation: The Unicode character is converted into its canonical UTF-8 octet sequence (between 1 and 4 bytes).
Octet Triplet Formatting: Each individual byte in the resulting sequence is formatted as %HH using uppercase hexadecimal digits.

Character	Code Point	UTF-8 Octets	Encoded Result	Encoding Classification
Space	U+0020	0x20	%20	ASCII Disallowed Control/Whitespace
&	U+0026	0x26	%26	ASCII Reserved Sub-delimiter
é	U+00E9	0xC3 0xA9	%C3%A9	2-byte Unicode (Latin-1 Supplement)
文	U+6587	0xE6 0x96 0x87	%E6%96%87	3-byte Unicode (CJK Unified Ideographs)
🚀	U+1F680	0xF0 0x9F 0x9A 0x80	%F0%9F%9A%80	4-byte Unicode (Supplementary Multilingual Plane)

Standard APIs Comparison: encodeURI() vs. encodeURIComponent()

The JavaScript runtime provides two distinct built-in functions with fundamentally different scopes. Selecting the wrong function is one of the most frequent sources of URI corruption in web development:

Standard Method	Intended Target Scope	Preserved Characters / Delimiters	Primary Risk if Misused
encodeURI()	A complete, fully formed URI string.	: / ? # [ ] @ ! $ & ' ( ) * + , ; =	Leaves delimiters unencoded inside query values, breaking parameter separation.
encodeURIComponent()	An isolated component (path segment, query key, or query value).	A-Z a-z 0-9 - _ . ! ~ * ' ( )	Encodes protocol and host slashes (`https%3A%2F%2F`), breaking URI routing.

The Space Discrepancy: %20 vs. the Plus Sign (+)

A common point of confusion is whether spaces should be encoded as %20 or +:

RFC 3986 Standard: Mandates %20 across all URI components. The plus sign is reserved as a sub-delimiter and represents a literal plus character unless escaped as %2B.
HTML Form Specification (application/x-www-form-urlencoded): A historical standard where form field values transmitted via HTTP GET or POST replace spaces with +.
API Signatures: Modern specifications—including OAuth 1.0a, AWS Signature Version 4, and OpenAPI—strictly enforce RFC 3986 percent-encoding. Supplying + instead of %20 in these contexts produces cryptographic signature mismatches.

Common URL Encoding Pitfalls & Debugging Techniques

Production issues often stem from subtle misunderstandings of URI boundaries and multi-layer decoding:

1. The Double-Encoding Cascade

When a string containing existing percent-encoded entities is passed to an encoder again, each existing percent sign (%) is replaced with %25. For example, an already encoded space (%20) becomes %2520. When the destination server performs a single decode pass, it receives the literal string %20 instead of a space.

2. Nested URL Parameter Leakage

When passing a target redirect URL as a query parameter (e.g., ?redirect=https://example.com/callback?a=1&b=2), failing to encode the entire target value with encodeURIComponent() causes the outer parser to interpret &b=2 as an attribute of the host URL rather than the redirect payload.

3. Truncated Multi-Byte Sequences

Calling decodeURIComponent() on an incomplete multi-byte sequence—such as the first byte of a Chinese character (%E6) without its two continuation bytes—immediately throws a URIError: URI malformed exception. Robust applications wrap decoding operations in defensive try/catch blocks.

Cross-Language Standard Library Implementation Guide

Standard library implementations across major backend languages handle RFC 3986 percent-encoding with native utilities:

JavaScript / Node.js (Modern URL API)

// Construct URLs safely using standard URLSearchParams
const params = new URLSearchParams();
params.set('search', 'hello world');
params.set('filter', 'category&tag');
const url = 'https://api.example.com/items?' + params.toString();
// Output: https://api.example.com/items?search=hello+world&filter=category%26tag

// Strict RFC 3986 percent-encoding (ensuring %20 for spaces)
const strictEncode = (str) => encodeURIComponent(str).replace(/[!'()*]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase());

Python 3 (urllib.parse)

import urllib.parse

# RFC 3986 percent-encoding (%20 for spaces)
encoded_component = urllib.parse.quote("hello world & data", safe="")
# Output: 'hello%20world%20%26%20data'

# Decode percent-encoded string
decoded = urllib.parse.unquote(encoded_component)

# Query string encoding (application/x-www-form-urlencoded with + for spaces)
form_encoded = urllib.parse.quote_plus("hello world & data")
# Output: 'hello+world+%26+data'

Go (net/url)

package main

import (
    "fmt"
    "net/url"
)

func main() {
    // QueryEscape encodes string for query parameters (+ for spaces)
    query := url.QueryEscape("hello world & key")
    
    // PathEscape encodes string for URL path segments (%20 for spaces)
    path := url.PathEscape("user folder/hello world")
    
    // Decoding
    unescaped, _ := url.QueryUnescape(query)
    fmt.Println(query, path, unescaped)
}

Java (java.net)

import java.net.URLEncoder;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;

public class UrlCodec {
    public static void main(String[] args) throws Exception {
        String raw = "hello world & user";
        // Encodes with + for spaces; replace with %20 for strict RFC 3986
        String encoded = URLEncoder.encode(raw, StandardCharsets.UTF_8.toString())
                                   .replace("+", "%20");
        String decoded = URLDecoder.decode(encoded, StandardCharsets.UTF_8.toString());
    }
}

PHP (rawurlencode vs. urlencode)

<?php
$input = "hello world & data";

// RFC 3986 compliant encoding (%20 for space)
$rfc3986 = rawurlencode($input);
// Output: hello%20world%20%26%20data

// Legacy form encoding (+ for space)
$formEncoded = urlencode($input);
// Output: hello+world+%26+data

// Decoding
$decoded = rawurldecode($rfc3986);
?>

Frequently Asked Questions

What is the difference between Component mode (encodeURIComponent) and Full URL mode (encodeURI)?

Component mode uses encodeURIComponent(), which escapes all reserved URL delimiters such as :, /, ?, #, &, and =. It is designed for encoding query parameter values or path chunks so they do not conflict with outer URL syntax. Full URL mode uses encodeURI(), which preserves structural URL characters (https://, /, ?, &) while encoding spaces and non-ASCII characters, making it ideal for encoding a complete web address without breaking its navigability.

Why does a space become %20 instead of a plus sign (+)?

RFC 3986 specifies the generic URI standard where spaces must be percent-encoded as %20. The plus sign (+) is a legacy encoding from the application/x-www-form-urlencoded specification used in HTML form submissions. In modern REST APIs, URL paths, and cryptographic signature algorithms (such as AWS Signature Version 4 and OAuth 1.0a), %20 is strictly required because + represents a literal plus character.

How do I encode a redirect or callback URL inside a query parameter?

When embedding a complete URL as a query string parameter (for example, ?redirect=https://example.com/auth?step=2&client=web), select Component mode (encodeURIComponent). This converts the nested ?, &, and / characters into %3F, %26, and %2F, ensuring the outer server parser does not misinterpret the inner URL parameters as part of the host request.

How does this tool process non-ASCII Unicode characters and emojis?

Under RFC 3986 Section 2.5, non-ASCII characters are first converted into their UTF-8 byte sequences (1 to 4 bytes). Each byte is then formatted into an uppercase %HH hexadecimal triplet. For example, accented é converts to two bytes (%C3%A9), Chinese characters like 文 convert to three bytes (%E6%96%87), and emojis like 🚀 convert to four bytes (%F0%9F%9A%80).

What causes the "Invalid URI sequence during decoding" error in this tool?

This error occurs when the input contains an invalid percent-encoding sequence that violates UTF-8 decoding rules. Common triggers include an isolated % character not followed by two valid hex digits, a truncated multi-byte UTF-8 sequence missing continuation bytes, or invalid surrogate pairs.

What is double URL encoding (e.g., %2520, %252F) and how do I fix it?

Double encoding occurs when an already percent-encoded string is encoded again, turning the % symbol into %25 (e.g., %20 becomes %2520). To resolve it, paste the double-encoded text into the Encoded panel of this tool to decode it back to single-encoded form, or perform a second decode pass to retrieve the raw string.

Which characters do NOT get encoded by this tool in Component mode?

Component mode uses JavaScript's built-in encodeURIComponent(), which leaves alphanumeric characters (A–Z, a–z, 0–9) and the symbols -, _, ., !, ~, *, ', (, and ) unencoded. Note that while ECMAScript preserves !, ~, *, ', (, and ) based on older RFC 2396 mark rules, RFC 3986 classifies !, *, ', (, and ) as reserved sub-delimiters. If your target system strictly requires RFC 3986 (such as OAuth 1.0a or AWS SigV4 signatures), those 5 characters must be escaped manually as %21, %2A, %27, %28, and %29.

URL Parser & Builder

Base64 Encoder & Decoder

cURL Converter