URL Encode / Decode

What is URL encoding?

URL encoding — also called percent-encoding — replaces characters that are unsafe or reserved in a URL with a % followed by their hexadecimal byte value. For example a space becomes %20 and an ampersand becomes %26. This keeps query strings, path segments and form data from breaking the structure of a URL.

encodeURIComponent vs encodeURI

There are two levels of encoding, and picking the wrong one is a frequent source of bugs:

• Component mode (encodeURIComponent) encodes everything that isn't unreserved, including / ? : @ & = + $ #. Use it for a single piece of data going into one query parameter or path segment.
• Full-URI mode (encodeURI) leaves the characters that form a valid URL intact, so it won't break ://, ? or &. Use it when encoding an entire URL that is already structured.

Rule of thumb: if you are building a query string from values, encode each value with component mode, then join them with & and = yourself.

Examples

• hello world → hello%20world
• a=b&c=d → a%3Db%26c%3Dd (component mode)
• café/münchen → caf%C3%A9%2Fm%C3%BCnchen

Notice that non-ASCII characters are encoded as their UTF-8 bytes — a single é becomes two percent-escapes (%C3%A9).

Common pitfalls

Double-encoding is the classic mistake: encoding a value that was already encoded turns %20 into %2520. If you see stray %25 sequences in your URLs, something encoded the same value twice. Decoding malformed input (an incomplete % sequence) also fails — this tool reports that instead of silently corrupting data.

Encoding is not escaping for HTML or SQL

URL encoding only makes text safe for URLs. It does not protect against XSS (use HTML escaping) or SQL injection (use parameterized queries). Reserved characters that are dangerous in those contexts need their own escaping — don't rely on percent-encoding as a security control.