ToolifyHub Team · Updated August 22, 2026 · 4 min read

URL Encoder & Decoder: Percent-Encode URLs, Paths & Query Parameters

Direct Answer & Definition

Percent-encode and decode URLs, paths, and query parameters online. Batch mode, auto-detect, UTM cleaner, tracking parameter scanner, security scoring, and RFC 3986 code snippets. 100% private browser-based tool.

Safely transform URLs and special characters for web compatibility using standard Percent-Encoding. Batch mode, UTM cleaner, tracking scanner, security scoring, and code snippets.

Instant

Private

Free

Last Updated: July 2026|Reviewed by: ToolifyHub.tools Editorial Team|100% Browser-Based Security

100% Private — No server uploads

RFC 3986 Compliant

Instant — No signup

Conversion Engine

Encoding standard: strict-rfc3986

Batch Mode

Input Length

120 Chars

Lines: 1

Output Length

150 Chars

Delta: +30

Query Parameters

0 Found

Clean Parameters

Encoding Safety

Strict 100%

Zero-Crash Certified

Input URL or String

Quick Tools:

Encoded Output Result

https%3A%2F%2Fexample.com%2Fsearch%3Fcategory%3Dmobile%20phones%26sort%3Dprice%20desc%26utm_source%3Dnewsletter%26utm_campaign%3Dsummer_sale%23results

Production Code Snippets (6 Languages)

Zero-dependency snippets with strict RFC 3986 and resilient decoding algorithms.

// JavaScript (ES6+) Strict RFC 3986 URL Encoding
function fixedEncodeURIComponent(str) {
  return encodeURIComponent(str).replace(/[!'()*]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase());
}
const raw = "https://example.com/search?category=mobile phones&sort=price desc&utm_source=newsletter&utm_campaign=summer_sale#results";
const encoded = fixedEncodeURIComponent(raw);
console.log(encoded);

Standards Compliance & Specifications

RFC 3986 Strict Percent-Encoding

Requires sub-delimiters ! ' ( ) * to be percent-encoded as %21 %27 %28 %29 %2A. Mandatory for AWS Signature V4 and OAuth 1.0 signatures.

Form-URL-Encoding (+ vs %20)

HTML form submissions encode spaces as +. In contrast, standard URIs require %20. Our dual-mode switch guarantees literal plus signs in emails and hashes are preserved.

Zero-Crash Lenient Fallback

While native decodeURIComponent crashes on stray % characters, our engine uses resilient pattern parsing to decode valid pairs while safely preserving literal text.

Production Best Practices

Never double-encode: Always inspect whether an incoming query string is already percent-encoded before encoding again.
Strip UTM tags before hashing: Marketing tracking tags inflate query string length and degrade caching efficiency.
Use Base64URL for tokens: Standard Base64 contains + and /, which mutate when transmitted inside URL parameters.

Security & Privacy Disclosure

Last Standards Audit: September 2026

Tested against RFC 3986, RFC 4648, and W3C WHATWG URL specifications.

100% Client-Side: Inputs are processed strictly in browser memory. Zero server storage.

URI vs URL vs URN — The Identity Hierarchy

RFC 3986: URI is the superset. URL locates, URN names. Don't confuse them.

URI (Identifier)

Generic syntax for identifying any resource. RFC 3986 defines URI = scheme:[//authority]path[?query][#fragment]. Superset of URL and URN.

URL (Locator)

Subset of URI that provides network location (how to access). Includes protocol, host, port. Example: https://example.com/path?query=1.

URN (Name)

Subset of URI that identifies resource by name, not location. Example: urn:isbn:0451450523. Persistent, location-independent.

IDNA & Punycode — Unicode Domains in DNS

IDNA (Internationalized Domain Names)

Allows Unicode in domain names (e.g., 例子.测试). DNS only understands ASCII, so IDNA converts to Punycode.

Punycode Encoding

Prefix: xn--. "例子.测试" → xn--fsq092h.xn--0zwm56d. Browser shows Unicode, DNS resolves ASCII.

Encoding Gotcha

Full URL with Unicode host: encode host separately (Punycode), then percent-encode path/query. Don't encode entire URL as one string.

Query String Normalization — Canonical Form for Caching & Signatures

Sort Parameters

Alphabetical sort by key ensures canonical form. a=1&b=2 → b=2&a=1 (sorted). Critical for caching, signatures, deduplication.

Deduplicate Keys

Repeated keys (a=1&a=2) → keep first or combine (a=1,2). OAuth requires single-value params; form data allows arrays.

Space Consistency

application/x-www-form-urlencoded: space → +. RFC 3986 / query component: space → %20. Pick one and be consistent.

OAuth 2.0 / OpenID Connect — Parameter Encoding Requirements

OAuth 2.0 / OIDC Parameters

redirect_uri, state, scope, code_challenge, code_challenge_method must be percent-encoded per RFC 3986.

Unreserved Chars Only

A-Z a-z 0-9 - . _ ~ are left bare. All others (including / ? # & =) must be encoded in parameter values.

PKCE Code Challenge

code_challenge = Base64URL(SHA256(code_verifier)). No padding. Must use Base64URL (not standard Base64).

Webhook Signature Encoding — HMAC + Base64URL

HMAC Signature Flow

1) Serialize payload (JSON, sorted keys). 2) HMAC-SHA256(payload, secret). 3) Base64URL encode digest. 4) Send in header (e.g., X-Signature).

Base64URL Not Base64

Signature in header must be URL-safe: +→-, /→_, omit = padding. Standard Base64 breaks in HTTP headers.

Timing Attack Prevention

Use constant-time comparison (crypto.timingSafeEqual) when verifying signatures. Never use === or strcmp.

Path vs Query vs Fragment — Different Encoding Rules

Path Component

Reserved: / (segment separator). Encode / only if it's data (e.g., /users/john%2Fdoe). Sub-delims (! $ & ' ( ) * + , ; =) encode as data.

Query Component

Reserved: ? & = # / @. Encode all as data. Space → %20 (RFC 3986) or + (form). Key=value pairs separated by &.

Fragment Component

After #. Not sent to server. Encode reserved chars if used as client-side data (e.g., SPA routing).

Double-Encoding Detection — The Silent URL Killer

%25XX Pattern Detection

Double-encoded: %20 → %2520. Detect by regex /%25[0-9A-Fa-f]{2}/. If found, decode once before processing.

Length Delta Check

decode(str).length vs str.length. If single decode reduces length significantly, likely double-encoded. Safe threshold: >5% reduction.

Reject & Warn

Never silently double-decode. Return error + suggestion: "Input appears double-encoded. Use decode once, then re-encode if needed."

Non-ASCII Percent-Encoding — UTF-8 Byte Sequences

UTF-8 → Percent-Encode

Unicode code point → UTF-8 bytes → each byte as %XX. "é" (U+00E9) → C3 A9 → %C3%A9. "😀" (U+1F600) → F0 9F 98 80 → %F0%9F%98%80.

JS: encodeURIComponent

Automatically handles UTF-8. encodeURIComponent('é') → '%C3%A9'. decodeURIComponent('%C3%A9') → 'é'. Never use escape/unescape (deprecated).

Don't Double-Encode UTF-8

Passing already-encoded %C3%A9 through encodeURIComponent → %25C3%25A9 (wrong). Check for %XX before encoding.

Reserved Character Context — Gen-delims vs Sub-delims

Gen-delims (Generic)

: / ? # [ ] @ — structural delimiters. Encode when appearing as data in path/query. In path: only encode if not serving structural role.

Sub-delims (Sub-component)

! $ & ' ( ) * + , ; = — allowed in path/query data but often encoded for safety. = & critical in query (key=value&a=b).

Context Matters

In path: / is separator → don't encode. In query value: / is data → encode as %2F. Same char, different meaning.

Percent-Decoding Security — Path Traversal & Injection

Path Traversal

Decoded %2E%2E%2F → ../ . If joining with base path without normalization, can escape directory. Always normalize after decode (resolve ./ ../).

Injection Vectors

Decoded %3Cscript%3E → <script>. If reflected in HTML without escaping → XSS. Decoded %27 OR 1=1 → ' OR 1=1. SQL injection if concatenated.

Safe Decode Pipeline

1) Percent-decode. 2) Validate charset (allowlist). 3) Normalize path (resolve ., ..). 4) Context-encode for output (HTML, SQL, JS, Shell).

Why You Actually Need an URL Encoder & Decoder

Percent-encode and decode URLs, paths, and query parameters with our free online URL Encoder & Decoder. Convert special characters in URLs to their percent-encoded format (URL encoding) for safe transmission over the internet, or decode encoded URLs back to readable format. This tool handles query parameters, path segments, and entire URLs with support for both UTF-8 and ASCII encoding standards, making it essential for modern web development, API integration, and digital marketing workflows.

URLs often contain characters that have special meanings in web addresses, such as spaces, ampersands, question marks, hash symbols, and non-ASCII characters. URL encoding replaces these characters with percent-encoded equivalents that web servers and browsers interpret correctly. Our tool goes beyond basic encoding by offering batch processing for multiple URLs, automatic mode detection for mixed inputs, UTM parameter cleaning for marketing campaigns, tracking parameter scanning for privacy audits, and security scoring to identify sensitive data exposure risks. Whether you're a developer debugging API requests, a marketer preparing campaign links, or a QA engineer testing form submissions, this tool provides the precision and flexibility you need.

The built-in code snippet generator exports ready-to-use examples in six programming languages — JavaScript, Python, PHP, Java, C#, and curl — so you can implement percent-encoding directly in your projects without manual translation. All processing happens locally in your browser using client-side JavaScript, meaning your URLs, query parameters, and sensitive data never leave your device. No server uploads, no logs, no tracking. This privacy-first approach is especially valuable when encoding URLs containing authentication tokens, user identifiers, or proprietary campaign parameters that must remain confidential.

Common use cases include: encoding UTM tracking links for email marketing campaigns to prevent client-side breakage; decoding console error logs containing percent-encoded JSON payloads for faster debugging; cleaning tracking parameters from referral URLs before internal processing; validating RFC 3986 compliance for API gateway configurations; and generating language-specific encoding functions for cross-platform development teams. The batch mode handles up to 50 URLs simultaneously, while the auto-detect feature intelligently switches between encode and decode modes based on input patterns, reducing manual切换 errors.

Why Use ToolifyHub.tools?

Our sandbox design enables safe local execution, removing the threat of third-party data collection inherent to typical online tools.

🔒 100% Privacy-First Sandbox

This tool runs entirely inside your browser. No files or inputs are sent to any external server.

❌ No Sign-Up or Accounts

Enjoy instant, anonymous access to all features without sharing email or credentials.

⚡ High-Speed Local Rendering

Optimized client-side rendering ensures near-zero processing wait times.

🎁 Free Forever with Zero Caps

Supported exclusively by simple display advertisements, keeping premium tools accessible to everyone.

🎯 Best For:Developers, students, office managers, and freelancers needing private document/calculation tasks.

💡 When to Use:Choose this when processing sensitive data, private text, spreadsheets, or images that should not sit in cloud databases.

🔑 Key Takeaway:Immediate browser execution guarantees zero storage leak vectors. A fast, clean, desktop alternative.

How to Use the URL Encoder & Decoder on ToolifyHub.tools

Paste Your Link or Text String

Insert the target URL or the query parameters you want to encode or decode into the main input box.

Select the Desired Action Mode

Choose either the encode option to make your text web-safe, or the decode option to translate percent-encoded characters back into readable text.

Choose the Coding Standard

Select whether you want standard encoding or strict URL path encoding, which handles special characters like slashes differently.

Review the Converted Output

Check the live preview field, which displays the translated link instantly as you make changes.

Copy the Result to Your Clipboard

Click the copy button to save the converted link and paste it into your code editor, API client, or marketing campaign tool.

Real-World Scenarios Where This Saves You

🎯

Formatting UTM Tracking Links

A marketing specialist needs to send a promotional link that includes a query string like '?utm_source=spring newsletter&utm_campaign=sales promo'. To prevent email clients from breaking on the spaces, they use the tool to encode the URL, translating the spaces into percent codes.

💼

Debugging API Requests

A software engineer is sending a GET request to an API that accepts search terms as query parameters. The term contains a plus sign and a hash symbol, which they encode using the tool to ensure the API receives the literal characters rather than treating them as system commands.

🚀

Translating Console Error Logs

A customer support agent receives a long, unreadable URL from a client's browser console that contains characters like '%7B%22user%22%3A%22john%22%7D'. They use the tool to decode the URL, revealing that it was passing a simple JSON object containing user details.

Common Mistakes to Avoid

✗

Double-encoding existing URL links: Pasting a web link that already contains percent-encoding and encoding it a second time will turn characters like '%20' into '%2520'. This corrupts the link structure and makes it completely invalid for web browsers.

✗

Encoding complete protocol prefixes: Running encoding on an entire URL, including 'https://', will convert the colon and slashes into percent codes like '%3A%2F%2F'. This makes the link unclickable because browsers no longer recognize the protocol.

✗

Confusing space encoding parameters: Different web standards handle spaces in different ways. Some APIs expect spaces to be encoded as '+', while others require '%20'. Make sure you choose the correct format that matches your server's expectations.

✗

Failing to encode critical hash symbols: If your URL parameters contain a hash symbol (#) that is meant to be part of the data, failing to encode it will cause the browser to treat everything after the hash as a page anchor, dropping the data.

How We Tested This Tool

To guarantee complete accuracy and reliability, our engineering and QA team validates the URL Encoder & Decoder regularly against:

Cross-Browser Compatibility: Verified on standard releases of Google Chrome, Apple Safari, Mozilla Firefox, and Microsoft Edge.
Responsive Viewports: Tested for mobile, tablet, and desktop dimensions to ensure layout responsiveness.
Input Assertions: Subjected to multiple normal, extreme, and empty parameters to prevent script failure and guarantee output correctness.

Local Browser Sandbox vs. Cloud Tools

Metric	ToolifyHub Sandbox	Typical Cloud Services
File Upload Risks	None (0% upload rate)	High (transmits data to remote servers)
Execution Cost	Free forever (No limits)	Subscription-gated or limits applied
Data Retention Policy	Immediate deletion on page close	Retained in cloud buckets or server logs
Processing Latency	Sub-second client execution	Network upload & queuing delays

Authoritative Specifications & Documentation

IETF RFC 3986 - Uniform Resource Identifier (URI): Generic Syntaxietf.org

WHATWG - URL Living Standard (URL Parsing & Percent-Encoding)whatwg.org

MDN Web Docs - encodeURIComponent() Referencemozilla.org

W3C - URIs, URLs, and URNs: Clarifications and Recommendationsw3.org

Frequently Asked Questions

Percent-encoding converts non-ASCII characters and special symbols in a URL into a '%' followed by two hex digits. This is necessary because URLs can only safely transmit a limited set of standard characters without breaking.

No, properly encoding your URLs does not harm SEO. Search engine bots are fully designed to read and index percent-encoded URLs, and search engines like Google will automatically display the decoded, readable versions in search results.

Not at all. The encoding and decoding happen entirely in your browser using local JavaScript, meaning your links, keys, and parameters never leave your computer.

If you encode a full URL at once, path slashes and protocol colons are converted to prevent them from being parsed. To keep them intact, only encode the specific parameter values or query strings.

encodeURI keeps structural URL characters (like colons, slashes, and question marks) intact to preserve the URL format, whereas encodeURIComponent encodes all non-alphanumeric characters, making it ideal for query parameters.

Official RFC 3986 Percent-Encoding Cheat Sheet

Quick reference guide for standard URI reserved character percent-encodings:

Space ' '

%20

Hash '#'

%23

Slash '/'

%2F

Colon ':'

%3A

Ampersand '&'

%26

Question '?'

%3F

Plus '+'

%2B

At '@'

%40

Equals '='

%3D

Exclamation '!'

%21

Dollar '$'

%24

Asterisk '*'

%2A

Single Quote '''

%27

Semicolon ';'

%3B

Comma ','

%2C

Open Paren '('

%28

Close Paren ')'

%29

Open Bracket '['

%5B

Close Bracket ']'

%5D

Related Tools & Workflows

Convert URLs to Base64, Format URL parameters as JSON, Generate QR codes from encoded URLs, Format Markdown with Encoded URLs