# URL Encoder & Decoder Encode or decode URL components, parse query parameters into a structured grid, and analyze URL structures instantly for free. --- - **Canonical URL:** https://dothecalculation.com/calculators/url-encoder-calculator - **Category:** Everyday utilities - **Publisher:** Do The Calculation (https://dothecalculation.com) - **Cost:** Free, no account or sign-up required - **Privacy:** Runs entirely in the browser; inputs are never sent to a server - **Methodology:** https://dothecalculation.com/methodology --- ## Encode & Decode URL components Convert query parameters, path elements, and special characters to URL-safe percentage encodings, or translate percentage-encoded text back into plain readable formats. - URL-safe percentage encoding - Automatic query string parameter parsing - Custom separator splitting ## Uniform Resource Identifiers and RFC 3986 Standards URL encoding, officially known as percent-encoding, is a standard mechanism defined in RFC 3986 to translate characters within a Uniform Resource Identifier (URI). Web communication protocols rely on structured text addresses to locate resources across the internet. However, URIs are restricted to a narrow subset of ASCII characters. Characters outside of this allowed subset (including symbols, punctuation, and non-ASCII characters such as emojis or non-Latin alphabets) must be encoded to prevent web servers and browsers from misinterpreting them. The encoding process converts unsafe characters into their corresponding byte values and represents them as a percent sign (%) followed by two hexadecimal digits. For instance, a space character (ASCII 32) is encoded as %20, a question mark (ASCII 63) is encoded as %3F, and an ampersand (ASCII 38) becomes %26. This translation ensures that URIs remain structurally intact as they traverse different network routers, load balancers, and application gateways. Under RFC 3986, characters are classified into two main sets: reserved and unreserved. Understanding the clear boundaries between these two groups is critical for designing robust web applications, query parsers, and API integrations. ## Reserved vs. Unreserved Character Rules • Unreserved characters are characters that have no special syntactic meaning in a URI. They consist of uppercase and lowercase English letters (A-Z, a-z), decimal digits (0-9), the hyphen (-), the period (.), the underscore (_), and the tilde (~). These characters are guaranteed to be safe and must never be encoded under any circumstances. • Reserved characters are characters that have special structural significance in a URI. This category includes delimiters such as the forward slash (/) for path separation, the question mark (?) for query string initialization, the ampersand (&) for parameter separation, the equals sign (=) for key-value assignment, and the colon (:) for port declaration. The complete set includes: !, *, ', (, ), ;, :, @, &, =, +, $, ,, /, ?, %, #, [, and ]. If a reserved character is used to represent data rather than a structural delimiter (for example, if a search query contains a literal question mark or an ampersand), it must be percent-encoded. Otherwise, URI parsers will misinterpret the query data as part of the URL structure, leading to application bugs, unexpected behaviors, and routing errors. ## JavaScript API Differences: encodeURI vs encodeURIComponent Web developers frequently use native JavaScript functions to handle percent-encoding, but picking the wrong function can break application routing. The two primary methods provided in the runtime environment are encodeURI and encodeURIComponent, and they behave differently: • encodeURI: This function is designed to encode a complete, functional URL. It assumes that the input already has structural delimiters in the correct places. Therefore, it does not encode reserved characters that are critical to the URL structure, such as h, t, t, p, :, /, ?, and &. For example, calling encodeURI("https://example.com/search?q=hello world") will only encode the space, returning "https://example.com/search?q=hello%20world". • encodeURIComponent: This function is designed to encode a single component of a URL, such as a query parameter value or a path segment. It assumes that the input is raw data that should not be interpreted as part of the URL layout. Consequently, it encodes all characters except unreserved ones. Calling encodeURIComponent("https://example.com/search?q=hello world") will escape the colons, slashes, and question marks, returning "https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dhello%20world". This ensures the entire string can be safely appended as a query parameter without corrupting the parent URL. ## Web Security, Double Encoding, and Injection Auditing URL encoding is not just a formatting requirement; it is a critical component of web security. One common vulnerability related to URL parsing is Open Redirect, which occurs when an application redirect parameter is not properly sanitized and encoded, allowing attackers to construct links that redirect users to malicious domains. Another security risk is double encoding. Double encoding occurs when a web server or middleware decodes a URI parameter, and then passes it to another backend service which decodes it a second time. Attackers exploit this by encoding characters twice. For example, the percent sign (%) is encoded as %25. Therefore, a dot-dot-slash sequence (../) used in directory traversal attacks can be encoded as %252e%252e%252f. A security filter that only checks for %2e%2e%2f will pass this input. However, if the application performs a double decode, the final resolved value becomes ../, bypassing the firewall. Developers must adopt a strict security model: user inputs should be validated only after all URL decoding steps have been completed, and data should be decoded exactly once. When constructing outgoing requests, parameters should be individually encoded using standard libraries to prevent injection attacks. ## How to Use This URL Encoder Choose Encode URL or Decode URL. In Encode mode, paste any text or full URL and select whether to escape all reserved characters (encodeURIComponent, for query parameter values) or only special characters outside a functional URL (encodeURI, for full addresses). In Decode mode, paste a percent-encoded string to recover the original text. If your input came from an HTML form submission, leave "Decode plus (+) as space" checked so plus signs convert back to spaces correctly. ## Worked Example: Encoding a Query with a Space Encoding the URL "https://example.com/search?q=hello world" with encodeURIComponent produces `https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dhello%20world` — every reserved character, including the colon, slashes, and question mark, is escaped. Encoding that same string with encodeURI instead produces `https://example.com/search?q=hello%20world` — only the space is escaped, because encodeURI assumes the colons, slashes, and question mark are already structural parts of a valid URL. ## Related Calculators This encoder is part of a Developer Tools cluster. For other text and payload encoding tasks, try the [Base64 Encoder & Decoder](/calculators/base64-codec-calculator) or the [Regular Expression Tester](/calculators/regex-tester-calculator). To validate structured API payloads, use the [JSON Formatter & Validator](/calculators/json-validator-calculator). ## Frequently asked questions ### Why do spaces turn into %20 or + in a URL? Spaces are encoded as %20 in standard URL component encoding (RFC 3986). However, in query strings sent via form submissions (application/x-www-form-urlencoded), they are historically represented as a plus sign (+) for readability and legacy compatibility. Standard decoders handle both. ### What is the difference between encodeURI and encodeURIComponent? encodeURI is used to encode a full, valid URL, preserving structural delimiters like slashes, colons, and question marks. encodeURIComponent encodes all reserved characters, making it ideal for escaping individual query parameter keys or values so they do not conflict with the URL structure. ### What is percent-encoding? Percent-encoding is a method of representing arbitrary characters within a URI by converting them to their byte values and representing those bytes as a percent sign (%) followed by two hexadecimal digits. For example, a comma (ASCII 44) becomes %2C. ### Which characters are unreserved and never URL-encoded? Unreserved characters under RFC 3986 include uppercase and lowercase English letters (A-Z, a-z), decimal digits (0-9), hyphens (-), periods (.), underscores (_), and tildes (~). These characters are guaranteed to remain unescaped in all standard decoders. ### What is double URL encoding and why is it a security risk? Double URL encoding is when a string is percent-encoded twice (e.g., encoding % to %25 first, then encoding other parts). It can bypass Web Application Firewalls (WAFs) if the security filter decodes the string once and checks it, but the backend application decodes it a second time to reveal malicious payloads. ### How are emojis and non-ASCII characters URL-encoded? Non-ASCII characters and emojis are first converted into their UTF-8 byte sequences. Each byte in the sequence is then individually percent-encoded. For example, the smiley emoji (😊) is represented by 4 bytes in UTF-8, which translates to %F0%9F%98%8A. ### Can URL encoding be used as a form of data encryption? No. URL encoding is a reversible formatting representation designed solely to ensure safe character transmission over HTTP. It provides no confidentiality or cryptographic strength, and anyone can instantly decode URL-encoded text using simple web tools. ### Why are square brackets [ and ] sometimes encoded? Under RFC 3986, square brackets are reserved characters used primarily for defining IPv6 host addresses in a URL. In query parameter strings or path segments, they must be percent-encoded (as %5B and %5D) to prevent parsing conflicts on modern servers. ### What is the difference between URL encoding and HTML escaping? URL encoding converts special characters to percent-hex values to prevent conflicts with URL structure. HTML escaping converts characters to XML/HTML entities (like < or ") to prevent browsers from interpreting user input as active HTML tags or scripts, defending against XSS. ### How can I safely decode URL parameters in Node.js? In modern Node.js and JavaScript, you should use the built-in decodeURIComponent() function for individual parameters, or use the global URLSearchParams class. URLSearchParams automatically parses query strings and decodes both %20 and plus signs (+) correctly. ## Related concepts - **Percentage encoding** — Representing bytes with a percent sign and two hexadecimal digits. - **URI RFC 3986 standard** — The official technical specification defining URI syntax and encoding rules. - **Cross-Site Scripting (XSS)** — A web security vulnerability allowing attackers to inject client-side scripts. ## Related guides - [Understanding Calculator Formulas: How DTC Turns Inputs into Results](https://dothecalculation.com/blog/site-guides/understanding-calculator-formulas) — Understand how Do The Calculation formulas are presented, what the explanation blocks mean, and how to verify calculator logic before using a result in a real decision. ## Related calculators - [HTML Entities Encoder & Reference Table](https://dothecalculation.com/calculators/html-entities-calculator) — Encode and decode HTML entities and browse a complete reference chart of special characters and ASCII codes instantly for free. - [Morse Code Translator & Audio Visualizer](https://dothecalculation.com/calculators/morse-code-calculator) — Encode and decode text to Morse code instantly with an interactive signal pulse timeline visualizer and per-character breakdown. - [Anagram & Scramble Word Solver](https://dothecalculation.com/calculators/anagram-solver) — Detect if two words are anagrams of each other, generate all letter permutations, and analyze character frequency with a sorted histogram. - [Base64 Text & File Converter](https://dothecalculation.com/calculators/base64-codec-calculator) — Convert text or files to Base64 encoding and decode Base64 strings back to their original format instantly with a file preview. - [Binary to Text & ASCII Translator](https://dothecalculation.com/calculators/binary-translator-calculator) — Translate binary code to readable ASCII text and vice versa, with a full bit-grid visualization showing each character encoding. - [Cron Expression Generator & Descriptor](https://dothecalculation.com/calculators/cron-generator) — Generate cron schedule expressions using interactive dropdowns and translate cron strings into human-readable text instantly and free. --- _This calculator is for general educational and reference purposes only. Results are estimates and should not be used as the sole basis for critical decisions._ --- _Source: [Do The Calculation](https://dothecalculation.com/calculators/url-encoder-calculator). Quote freely with attribution and a link to this page._