100% Client-Side & Server-Supported • RFC 3986 & WHATWG Ready • Instant Live Conversion

URL Encoder & Decoder

Encode or decode URLs, query strings, and URI components into standard RFC 3986 percent-encoded format or plain human-readable text. Fast, secure, and client-side with full UTF-8 Unicode & emoji support.

What is URL Percent-Encoding? URLs can only be transmitted over the Internet using the standard ASCII character set. Any reserved characters (such as ?, &, =, /, #, :) or non-ASCII characters (including spaces, symbols, international text, and emojis) must be converted into a percent sign (%) followed by two hexadecimal digits representing their UTF-8 byte value. This ensures query parameters, REST API routes, and OAuth callbacks transmit safely without corruption.

Presets:Search Query with SymbolsREST API with JSON QueryOAuth2 Authorize URLUnicode & Emojis 🚀UTM Tracking CampaignAll Special Delimiters

Plain URL / Text to Encode

0 chars | 0 bytes

Upload File

Percent-Encoded Output

RFC 3986 Ready

0 chars | 0 bytes

0 B

Input Size

0 B

Output Size

%XX Entities

Size Overhead

Copied to clipboard!

Quick Answer & Key Takeaways (TL;DR)

Verified & Updated: October 2026

What is URL Percent-Encoding? URL encoding (percent-encoding) is an Internet standard defined in IETF RFC 3986. It converts reserved delimiters (such as ?, &, =, /, :, #) and unsafe or non-ASCII characters into an ASCII-safe %HH triplet (where HH represents two hexadecimal digits of the UTF-8 byte). This ensures that web browsers, REST APIs, OAuth2 identity providers, and server routing systems can parse web addresses unambiguously without query parameter truncation or injection attacks.

Target Audience

Web developers, backend API designers, SEO specialists, QA testers, and DevOps engineers.

Common Use Cases

Query string parameters, OAuth2 redirect URIs, UTM tracking tags, and RESTful API URLs.

RFC Standards

RFC 3986 (URI Standard), RFC 1738 (Legacy URL), and WHATWG URL Living Standard.

Security Impact

Prevents Cross-Site Scripting (XSS), Parameter Pollution (HPP), and Header Splitting.

What is URL Encoding (Percent-Encoding) and How Does RFC 3986 Work?

Direct Answer: URL encoding (percent-encoding) converts reserved delimiters, spaces, and non-ASCII characters in Uniform Resource Identifiers (URIs) into a percent symbol (%) followed by two hexadecimal digits representing their UTF-8 byte sequence. Standardized under IETF RFC 3986, this ensures web addresses transmit safely across all web servers and networks without character corruption.

The Uniform Resource Identifier (URI) specification is the foundational addressing protocol of the World Wide Web. By design, a URI uses a strict syntax of delimiters (such as :, /, ?, #, [, ], @, !, $, &, ', (, ), *, +, ,, ;, =) to distinguish between protocols, hosts, port numbers, directories, query parameters, and anchor fragments.

When user data containing these special characters is placed inside a parameter (for instance, searching for "C++ & Java" or setting a return URL like "https://example.com/callback?auth=true"), using unencoded symbols causes web servers to misinterpret where parameters begin and end.

As defined in the official IETF RFC 3986 specification, percent-encoding solves this by transforming every non-permitted character into its two-digit hexadecimal representation prefixed with %:

Unreserved Characters (Never Encoded):A–Z, a–z, 0–9, hyphen (-), underscore (_), period (.), and tilde (~).
Reserved Delimiters (Encoded within Component Values):: (%3A), / (%2F), ? (%3F), # (%23), & (%26), = (%3D), + (%2B), $ (%24).
Unsafe & Control Characters: Space (%20), double quote " (%22), less-than < (%3C), greater-than > (%3E).

If you are working with binary transformations or hash validation alongside URL parameters, you can also explore our Base64 Encoder & Decoder, our MD5 Hash Generator, and our Online UUID Generator.

Step-by-Step Translation Walkthrough: Encoding a Search Query

Let us examine how a query parameter containing spaces and symbols (e.g. q=PHP & MySQL?) is translated into standard RFC 3986 format:

Character	Character Type	ASCII / UTF-8 Hex	Percent-Encoded Form	Reason for Encoding
`P`, `H`, `P`	Unreserved Letters	`0x50`, `0x48`, `0x50`	PHP	Letters (A-Z) are safe and never encoded.
(Space)	Whitespace	`0x20`	%20	Spaces are invalid in raw URLs; represented as `%20`.
`&` (Ampersand)	Reserved Delimiter	`0x26`	%26	Prevents splitting the value into another query parameter.
`MySQL`	Unreserved Letters	`0x4D...`	MySQL	Letters are safe.
`?` (Question Mark)	Reserved Delimiter	`0x3F`	%3F	Prevents starting an invalid second query string.

What is the Difference Between encodeURI(), encodeURIComponent(), and application/x-www-form-urlencoded?

Direct Answer:encodeURI() is intended for encoding a complete URL without breaking its structural delimiters (like https://, /, ?, #). encodeURIComponent() is designed for encoding individual parameter values and encodes all reserved delimiters. application/x-www-form-urlencoded is the legacy HTML form standard that replaces spaces with plus signs (+) instead of %20.

One of the most frequent sources of web bugs is choosing the incorrect encoding function. In JavaScript, PHP, Python, and other programming environments, different functions are designed for specific layers of a web address:

Full URL Encoding (encodeURI / WHATWG URI): Preserves characters that have structural meaning in a complete URL (:, /, ?, #, &, =, @). Use this when you have a full web address that may contain international characters or spaces and you want to ensure it is valid ASCII without corrupting the link.
Component / Query Value Encoding (encodeURIComponent / PHP rawurlencode): Encodes everything except unreserved characters (A-Z, a-z, 0-9, -, _, ., ~). Use this whenever you are assembling query string keys and values (e.g., ?param= + encodeURIComponent(val)).
Form Data Encoding (application/x-www-form-urlencoded / PHP urlencode): The historical standard used by HTML forms. Replaces spaces with + instead of %20.

Character / Symbol	Raw Input	encodeURI() (Full URL)	encodeURIComponent() (Param Value)	x-www-form-urlencoded (Form Data)
Space		`%20`	`%20`	`+`
Forward Slash	`/`	`/` (Preserved)	`%2F`	`%2F`
Question Mark	`?`	`?` (Preserved)	`%3F`	`%3F`
Ampersand	`&`	`&` (Preserved)	`%26`	`%26`
Equal Sign	`=`	`=` (Preserved)	`%3D`	`%3D`
Plus Sign	`+`	`+` (Preserved)	`%2B`	`%2B`
Colon	`:`	`:` (Preserved)	`%3A`	`%3A`
Hash / Fragment	`#`	`#` (Preserved)	`%23`	`%23`

Which Characters Are Reserved vs. Unreserved in URIs According to RFC 3986?

Direct Answer: RFC 3986 defines unreserved characters (A-Z, a-z, 0-9, -, _, ., ~) which must never be percent-encoded, and reserved characters (divided into general delimiters like :/?#[]@ and sub-delimiters like !$&'()*+,;=) which must be encoded when used outside their syntactic delimiter role.

To avoid ambiguity across different browsers, proxy servers, and web application firewalls (WAFs), the following matrix outlines every special character and its corresponding percent-encoding:

Character	Hex Code	RFC 3986 Classification	Description & URI Role	Must Encode in Query Values?
`A–Z, a–z, 0–9`	—	Unreserved	Standard alphanumeric characters	No
`- _ . ~`	—	Unreserved	Hyphen, underscore, period, tilde	No
(Space)	`%20`	Disallowed	Whitespace separator	Yes (%20)
`:`	`%3A`	Gen-delim	Scheme & port separator	Yes (%3A)
`/`	`%2F`	Gen-delim	Path segment delimiter	Yes (%2F)
`?`	`%3F`	Gen-delim	Query string start delimiter	Yes (%3F)
`#`	`%23`	Gen-delim	Fragment / Anchor identifier	Yes (%23)
`&`	`%26`	Sub-delim	Query parameter separator	Yes (%26)
`=`	`%3D`	Sub-delim	Parameter name/value separator	Yes (%3D)
`+`	`%2B`	Sub-delim	Plus symbol (interpreted as space in forms)	Yes (%2B)
`%`	`%25`	Escape Prefix	Percent escape indicator	Yes (%25)

How Does Multi-Byte Unicode & UTF-8 Percent-Encoding Work?

Direct Answer: Multi-byte Unicode characters (such as Arabic, Chinese, Japanese, Cyrillic, Hindi, or emojis) are first transformed into their sequence of 1 to 4 UTF-8 binary bytes. Each byte is then formatted as a two-digit hexadecimal percent triplet (%XX), creating strings like %E4%BD%A0%E5%A5%BD for "你好" or %F0%9F%9A%80 for the rocket emoji (🚀).

In the early days of the Internet, URLs were strictly limited to 7-bit ASCII. With the globalization of the web and the introduction of Internationalized Resource Identifiers (IETF RFC 3987), web standards adopted UTF-8 as the mandatory encoding scheme for non-ASCII characters:

1 Byte (ASCII 0–127): Standard characters like A (0x41).
2 Bytes (U+0080 to U+07FF): Accented Latin, Greek, Arabic, Hebrew, and Cyrillic (e.g. é → %C3%A9).
3 Bytes (U+0800 to U+FFFF): Chinese, Japanese Kanji, Korean Hangul, Devanagari (e.g. 東京 → %E6%9D%B1%E4%BA%AC).
4 Bytes (U+10000 to U+10FFFF): Modern Unicode emojis and historic scripts (e.g. 🚀 → %F0%9F%9A%80, ✨ → %E2%9C%A8).

How to Encode and Decode URLs in JavaScript, Python, PHP, Java, and C#?

Direct Answer: Modern programming languages provide built-in libraries for RFC 3986 percent-encoding: JavaScript uses encodeURIComponent(), Python uses urllib.parse.quote(), PHP uses rawurlencode(), Java uses URLEncoder.encode(), and C# uses Uri.EscapeDataString().

Here are copy-pasteable code examples across all major developer languages:

1. JavaScript (Browser & Node.js)

// Encode query parameter value (RFC 3986) const paramValue = "C++ & JavaScript? price=$50"; const encodedParam = encodeURIComponent(paramValue); console.log(encodedParam); // "C%2B%2B%20%26%20JavaScript%3F%20price%3D%2450" // Decode back to plain text const decodedParam = decodeURIComponent(encodedParam); console.log(decodedParam); // "C++ & JavaScript? price=$50" // Full URL encoding const fullUrl = "https://example.com/wiki/東京?query=hello world"; console.log(encodeURI(fullUrl)); // "https://example.com/wiki/%E6%9D%B1%E4%BA%AC?query=hello%20world"

2. Python 3 (urllib.parse)

import urllib.parse # RFC 3986 encoding (quote) query = "PHP & Python? price=$100" encoded = urllib.parse.quote(query, safe='') print(encoded) # 'PHP%20%26%20Python%3F%20price%3D%24100' # Decode back decoded = urllib.parse.unquote(encoded) print(decoded) # 'PHP & Python? price=$100' # Encode query dictionary params = {'q': 'machine learning', 'category': 'AI & Data'} query_string = urllib.parse.urlencode(params) print(query_string) # 'q=machine+learning&category=AI+%26+Data'

3. PHP 8+ (rawurlencode vs urlencode)

<?php $input = "Laravel & Symfony? price=$75"; // RFC 3986 Standard Encoding (spaces become %20) $encodedRfc = rawurlencode($input); echo $encodedRfc; // "Laravel%20%26%20Symfony%3F%20price%3D%2475" // Decode $decoded = rawurldecode($encodedRfc); echo $decoded; // "Laravel & Symfony? price=$75" // Build query string from associative array $params = ['search' => 'web tools', 'tag' => 'php & js']; $queryString = http_build_query($params, '', '&', PHP_QUERY_RFC3986); echo $queryString; // "search=web%20tools&tag=php%20%26%20js" ?>

4. Java 17+ (URLEncoder & java.net.URI)

import java.net.URLEncoder; import java.net.URLDecoder; import java.nio.charset.StandardCharsets; public class UrlExample { public static void main(String[] args) { String text = "Java & Spring Boot? release=2026"; // Encode (converts space to +; replace with %20 for strict RFC 3986) String encoded = URLEncoder.encode(text, StandardCharsets.UTF_8).replace("+", "%20"); System.out.println(encoded); // Decode String decoded = URLDecoder.decode(encoded, StandardCharsets.UTF_8); System.out.println(decoded); } }

5. C# / .NET (Uri.EscapeDataString)

using System; class Program { static void Main() { string rawText = "C# & .NET Core? status=active"; // Strict RFC 3986 component encoding string encoded = Uri.EscapeDataString(rawText); Console.WriteLine(encoded); // "C%23%20%26%20.NET%20Core%3F%20status%3Dactive" // Decode string decoded = Uri.UnescapeDataString(encoded); Console.WriteLine(decoded); // "C# & .NET Core? status=active" } }

URL Encoding Security Best Practices: Preventing XSS, Parameter Pollution & Header Injection

Direct Answer: Always percent-encode untrusted user input before interpolating it into URL parameters, redirect headers, or HTML links. Proper encoding neutralizes Cross-Site Scripting (XSS) payloads (<script> → %3Cscript%3E), prevents HTTP Parameter Pollution (HPP), and eliminates HTTP Response Splitting via CRLF (%0D%0A) injection.

In secure software engineering, URLs are a primary attack vector. Failing to sanitize or encode URL components introduces severe security vulnerabilities:

Reflected Cross-Site Scripting (XSS): When user-supplied query parameters are reflected into an HTML page without contextual encoding or escaping, attackers can execute arbitrary JavaScript. Encoding < as %3C and " as %22 neutralizes the script execution.
HTTP Parameter Pollution (HPP): If an application accepts unencoded & or = in a parameter value, an attacker can append hidden parameters (e.g. ?user=john&role=admin), tricking backend systems into granting elevated privileges.
CRLF Injection / HTTP Response Splitting: Unescaped carriage returns (\r or 0x0D) and line feeds (\n or 0x0A) in URL redirects allow attackers to inject malicious HTTP response headers or forge entire response bodies.
Open Redirect Attacks: When validating redirect URLs in OAuth2 workflows, always decode and validate the hostname against a strict domain whitelist.

Frequently Asked Questions

Everything you need to know about URL percent-encoding, RFC standards, and query parameter handling.

URL encoding (also known as percent-encoding) is a mechanism defined in IETF RFC 3986 to represent arbitrary data within Uniform Resource Identifiers (URIs). Because URLs may only contain a limited subset of printable ASCII characters, any reserved characters (such as ?, &, =, /, :, #) or non-ASCII characters (such as spaces, accented letters, and emojis) must be converted into a "%" followed by two hexadecimal digits representing their UTF-8 byte value. This prevents intermediate routers, web servers, and browsers from misinterpreting parameters as delimiters.

Explore Related Developer & Text Tools

Streamline your daily data formatting, encoding, and web development workflows.