URL encoder & decoder

How to use it

1. Paste the text or URL, then choose Encode or Decode.
2. Use Component mode for a single query value, and Full URL mode when you are encoding a whole address.
3. Copy the result.

Reserved, unreserved, and why the two modes exist

RFC 3986 sorts characters into three groups. The unreserved set — letters, digits, hyphen, full stop, underscore and tilde — never needs escaping and should not be escaped, since %41 and A are defined as equivalent and a server may or may not normalise before matching a route. The reserved set is the delimiters that give a URL its structure: escaped, a slash is data; unescaped, it is syntax.

JavaScript’s two functions split along that seam. encodeURIComponent escapes the reserved set, so an ampersand inside a value cannot start a new parameter. encodeURI leaves it intact, which is right for a whole address and wrong for any fragment of one. Both were specified against the older RFC 2396 and leave apostrophe, brackets, exclamation mark and asterisk unescaped — a deviation that OAuth 1.0 signature base strings, which require them encoded, do notice.

Double encoding, and the bugs that live in the second decode

The classic failure is encoding a value twice. The percent sign itself requires escaping, so %20 encoded again becomes %2520, and what arrives is the literal text %20 rather than a space. It happens whenever a form library escapes a value and hand-built concatenation escapes it again. The symptom is a query string that looks nearly right, with a doubled percent run wherever a space or slash used to be.

It is also a security pattern with a catalogue entry. Where a filter decodes once and inspects while the application decodes again before use, %252e%252e%252f passes inspection as inert text and arrives as ../ — CWE-174, double decoding of the same data. Decoding here is a single pass on purpose: percent sequences left in the output mean the input really was encoded twice.

Questions