Why do spaces turn into %20 or + in a URL?

Spaces are encoded as %20 in standard URL component encoding (RFC 3986). However, in query strings sent via form submissions (application/x-www-form-urlencoded), they are historically represented as a plus sign (+) for readability and legacy compatibility. Standard decoders handle both.

What is the difference between encodeURI and encodeURIComponent?

encodeURI is used to encode a full, valid URL, preserving structural delimiters like slashes, colons, and question marks. encodeURIComponent encodes all reserved characters, making it ideal for escaping individual query parameter keys or values so they do not conflict with the URL structure.

What is percent-encoding?

Percent-encoding is a method of representing arbitrary characters within a URI by converting them to their byte values and representing those bytes as a percent sign (%) followed by two hexadecimal digits. For example, a comma (ASCII 44) becomes %2C.

Which characters are unreserved and never URL-encoded?

Unreserved characters under RFC 3986 include uppercase and lowercase English letters (A-Z, a-z), decimal digits (0-9), hyphens (-), periods (.), underscores (_), and tildes (~). These characters are guaranteed to remain unescaped in all standard decoders.

What is double URL encoding and why is it a security risk?

Double URL encoding is when a string is percent-encoded twice (e.g., encoding % to %25 first, then encoding other parts). It can bypass Web Application Firewalls (WAFs) if the security filter decodes the string once and checks it, but the backend application decodes it a second time to reveal malicious payloads.

How are emojis and non-ASCII characters URL-encoded?

Non-ASCII characters and emojis are first converted into their UTF-8 byte sequences. Each byte in the sequence is then individually percent-encoded. For example, the smiley emoji (😊) is represented by 4 bytes in UTF-8, which translates to %F0%9F%98%8A.

Can URL encoding be used as a form of data encryption?

No. URL encoding is a reversible formatting representation designed solely to ensure safe character transmission over HTTP. It provides no confidentiality or cryptographic strength, and anyone can instantly decode URL-encoded text using simple web tools.

Why are square brackets [ and ] sometimes encoded?

Under RFC 3986, square brackets are reserved characters used primarily for defining IPv6 host addresses in a URL. In query parameter strings or path segments, they must be percent-encoded (as %5B and %5D) to prevent parsing conflicts on modern servers.

What is the difference between URL encoding and HTML escaping?

URL encoding converts special characters to percent-hex values to prevent conflicts with URL structure. HTML escaping converts characters to XML/HTML entities (like < or ") to prevent browsers from interpreting user input as active HTML tags or scripts, defending against XSS.

How can I safely decode URL parameters in Node.js?

In modern Node.js and JavaScript, you should use the built-in decodeURIComponent() function for individual parameters, or use the global URLSearchParams class. URLSearchParams automatically parses query strings and decodes both %20 and plus signs (+) correctly.

utility calculator

URL Encoder & Decoder

Encode or decode URL components, parse query parameters into a structured grid, and analyze URL structures.

Formula Verified by Dr. Arthur Pendelton, PhD

Inputs

Input Text / URL

Characters: 0

Options

Encode All Reserved Characters (encodeURIComponent)Encode Special Characters Only (encodeURI)

Result

Characters: 0

Results

Related guides

Learn more about this calculation

Guide

Understanding Calculator Formulas: How DTC Turns Inputs into Results

Understand how Do The Calculation formulas are presented, what the explanation blocks mean, and how to verify calculator logic before using a result in a real decision.

Site Guide

How to Use Do The Calculation Calculators: A Practical Step-by-Step Guide

Learn the fastest reliable workflow for using Do The Calculation calculators, reading results, checking formulas, and using save, print, share, and export actions correctly.