URL Encoder and Decoder

Three encodings, and why offering one is wrong

This is where most tools quietly mislead. Percent-encoding is not a single operation, and picking the wrong one of the three is usually the bug that brought you here.

Component encoding escapes everything structural - ampersand, equals, question mark, slash, hash - and is what you want for a single value going into a query string. Full-URL encoding deliberately leaves those alone, because escaping the slashes in a scheme produces something that is no longer a URL. Form encoding is component encoding with space as plus rather than percent-twenty, which is what HTML forms and most HTTP clients send by default.

The last one is not interchangeable with the others. In form encoding a literal plus decodes to a space, so round-tripping a value through the wrong mode silently corrupts any plus sign in it - a base64 payload in a query parameter is the usual casualty.

Double-encoding, named

A percent-twenty-five-twenty in a production URL means a percent sign was itself encoded: the value went through an encoder twice, almost always because one layer encoded something that arrived already encoded. The decoder flags that pattern explicitly rather than leaving you to notice that decoding twice gives a different answer.

Alongside it, the tool splits the URL with the platform’s own parser and lists the query parameters decoded, so you can see the values as the server will receive them rather than as they appear on the wire.

Strict mode, and who needs it

The standard component encoder leaves exclamation marks, apostrophes, parentheses and asterisks unescaped. That is fine almost everywhere and fatal in two places: OAuth 1.0a signature base strings and AWS Signature Version 4 both require them escaped, and a mismatch there produces a signature failure with no other symptom. Strict mode escapes them.

What this does not do

Percent-encoding is not HTML escaping and it is not encryption. It makes a string safe to put in a URL; it does nothing about cross-site scripting, and it conceals nothing from anybody, since any parser reverses it trivially.

It also cannot tell you which layer of your stack applied an encoding. The tool shows what each mode would produce; deciding which part of the request path did it is still yours.