🌐 中文
Developer Tools

🔗 URL Encoder & Decoder

Encode and decode URLs and URI query parameters. Automatically parse URL parameters into an editable table or serialize parameters into encoded query strings.

Parsed Query Parameters

The Definitive Guide to URL Percent-Encoding & URI Components

Uniform Resource Identifiers (URIs) and URLs operate under strict transmission grammar governed by RFC 3986. Because URLs are transmitted across internet protocols that historically only guaranteed reliable routing for standard US-ASCII characters, any character falling outside the unreserved character set must undergo percent-encoding (also referred to as URL escaping).

When a character is percent-encoded, it is first mapped to its binary byte representation in UTF-8. Each resulting byte is expressed as a three-character sequence: a leading percent sign (%) followed by two hexadecimal digits representing the byte's numeric value (00 through FF). For instance, a basic whitespace character is represented by hex value 0x20, rendering as %20.

Reserved vs. Unreserved Characters Reference

Category Characters Included Encoding Behavior Purpose & Usage
Unreserved A-Z, a-z, 0-9, -, _, ., ~ Never encoded Safe for all URL components without risk of delimiter confusion
Reserved (Delimiters) :, /, ?, #, [, ], @, !, $, &, ', (, ), *, +, ,, ;, = Encoded when used as payload data Delimit scheme, host, path, query string, and anchor fragments
Non-ASCII & Unicode Chinese, Cyrillic, Emoji, Accents UTF-8 multi-byte percent encoded Converted into 2 to 4 percent-encoded octets per character

Practical Developer Best Practices

  • Always Encode Query Values Independently: Never call encodeURIComponent() on an entire URL, because it will destroy structural markers like https:// and ?. Instead, construct your URL base, and encode each parameter key and value individually.
  • OAuth and Webhook Redirects: Callback URLs passed within an authentication query string (e.g. redirect_uri=https%3A%2F%2Fapp.com%2Fcallback) must be strictly encoded to prevent open-redirect vulnerabilities.
  • XSS Prevention: Unsanitized URL parameters injected directly into DOM innerHTML or href attributes can trigger Cross-Site Scripting (XSS). Always decode on the application logic layer and sanitize before rendering.

How to Use This URL Encoder

  1. Input URL/Text: Paste the raw web address, URI query string, or special characters into the input box.
  2. Select Action: Click Encode URL (Component) to percent-encode non-ASCII characters and delimiters, or click Decode URL to unescape %20, %3F, etc. into readable text.
  3. Adjust Query Parameters: Optionally use the parameter inspector to review key-value pairs individually and edit parameters in real-time.
  4. Copy Result: Click Copy to copy the sanitized URL or clean query string ready for API payloads or browser address bars.

Frequently Asked Questions (FAQ)

Q: What is the difference between encodeURI() and encodeURIComponent()?

encodeURI() is designed for full URLs and intentionally avoids encoding URL syntax tokens like ://, /, ?, and &. encodeURIComponent() encodes every character that could conflict with URI grammar, making it the proper choice for parameter values.

Q: Why does '+' sometimes turn into a space when decoded?

In the legacy HTML form standard (application/x-www-form-urlencoded), spaces were converted to plus signs (+). In modern RFC 3986 percent-encoding, spaces are %20. ToolNexus intelligently parses both conventions.

Q: Is my pasted URL sent to any remote telemetry server?

No. The decoding, encoding, and parameter decomposition routines run exclusively within your browser's JavaScript sandbox. No API keys or session tokens are ever leaked.