URL Encoder & Decoder

encodeURIComponent encodes everything except letters, digits, and - _ . ! ~ * ' ( ) — it is designed for encoding a single component (like a query string value). encodeURI also preserves URL-structural characters like : / ? # [ ] @ ! $ & ' ( ) * + , ; = — it encodes a whole URL while keeping its structure intact. For encoding a parameter value, always use encodeURIComponent.

Spaces can be encoded as %20 (standard percent-encoding) or + (application/x-www-form-urlencoded format used in HTML form submissions). They are technically different encodings: %20 is correct for path segments and query values in full URLs; + is only valid inside application/x-www-form-urlencoded query strings. Always use %20 (encodeURIComponent) in modern code unless you are specifically targeting form-encoded data.

Reserved characters that have special meaning in URLs (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) must be encoded when used as data. Unsafe characters that must always be encoded include spaces, { } | \ ^ ` < >, and characters outside the ASCII printable range. All other non-ASCII characters (Unicode) must be UTF-8 encoded first, then percent-encoded.

Non-ASCII characters are first encoded as UTF-8 bytes, then each byte is percent-encoded. For example, the emoji 😀 (U+1F600) encodes to UTF-8 bytes F0 9F 98 80, which becomes %F0%9F%98%80 in a URL. Modern browsers handle this automatically in the address bar, but when constructing URLs in code you must use encodeURIComponent() which handles UTF-8 encoding for you.

Double encoding happens when an already-encoded URL is encoded again — %20 becomes %2520 (encoding the % sign). This typically occurs when building URLs from dynamic data that was already encoded, or when passing encoded URLs through multiple encoding layers. Always encode data values before adding them to a URL, and decode once on receipt. Never encode an entire URL that already contains valid percent-encoding.

Use decodeURIComponent to decode a single URL component (a query value, path segment). Use decodeURI to decode a whole URL while preserving the characters that have structural meaning (: / ? # @ etc.). In most API and form-handling code, you will use decodeURIComponent. This tool's decoder uses decodeURIComponent for maximum compatibility.

URL encoding is not a security control against SQL injection or XSS — it is for making data safe for transmission in URLs, not for making data safe for insertion into SQL queries or HTML. For SQL injection prevention, use parameterized queries. For XSS prevention, use context-appropriate output encoding (HTML entity encoding for HTML contexts, JSON encoding for script contexts). URL-encoding user input before putting it in a URL is correct for URL safety, but is a separate concern from SQL and HTML safety.

The HTTP specification does not set a maximum URL length, but practical limits exist. Most browsers support URLs up to 64,000–100,000 characters. Web servers (Apache, Nginx) typically allow 4,000–8,000 characters by default. The Internet Explorer limit was 2,083 characters, which became an informal standard. When URL-encoding large amounts of data as query parameters, consider switching to a POST request with a JSON body instead of a GET request.

The "URI malformed" error occurs when decodeURIComponent encounters invalid percent-encoding sequences — such as a lone % not followed by two hex digits, or incomplete multibyte UTF-8 sequences. This can happen with truncated data, incorrect manual encoding, or content that contains literal percent signs that weren't meant as encoding markers. Ensure the input is a well-formed percent-encoded string before decoding.