# urlencodedecode.com — Full Reference

> A free, privacy-first URL encoder and decoder. All encoding and decoding runs entirely in the browser via client-side JavaScript — pasted URLs and text are never uploaded to any server, and the tools work offline. Built for developers, digital marketers, and anyone working with web addresses.

## What URL encoding is

URL encoding (percent-encoding), defined in RFC 3986, represents characters that are unsafe or reserved in a URL as a percent sign followed by two hexadecimal digits. A space becomes %20, a question mark %3F, and a non-ASCII character like é becomes its UTF-8 bytes %C3%A9. It exists because the HTTP request line only permits a limited subset of US-ASCII; encoding lets special characters, spaces, and non-English text travel through browsers, proxies, and servers without breaking URL syntax. Encoding is fully reversible and provides no security — it is a transport format, not encryption.

## Core standards this site follows

- RFC 3986 (URI Generic Syntax): Section 2.1 defines percent-encoding (pct-encoded = "%" HEXDIG HEXDIG); Section 2.2 the reserved set (: / ? # [ ] @ ! $ & ' ( ) * + , ; =); Section 2.3 the unreserved set (A–Z a–z 0–9 - _ . ~). Hex digits are case-insensitive but should be normalized to uppercase.
- RFC 3629 (UTF-8): the byte encoding wrapped by percent-encoding for non-ASCII characters.
- WHATWG URL Standard: defines application/x-www-form-urlencoded, where a space is "+" (used by HTML forms and URLSearchParams) — distinct from RFC 3986's %20.
- RFC 4648: Base64 and the URL-safe Base64URL alphabet.

## Privacy model

Every tool runs entirely in client-side JavaScript. Input never leaves the browser tab; there is no server-side processing of user data, no upload, and the tools continue to work with the network disconnected. This makes them safe for URLs containing tokens, session IDs, or other sensitive values. The site uses analytics and advertising but does not transmit tool inputs.

## Tools and their capabilities

### URL Decoder (/decode.html)
Percent-decodes any string. Options: destination character set (50+ charsets including UTF-8, Windows-1252, ISO-8859 family, Shift_JIS, EUC-JP, GBK, Big5, KOI8-R, and more); "Treat + as space" toggle for form vs path decoding; "Decode recursively" (up to 16 passes, for double/triple-encoded input); "Decode each line separately" for batch decoding; live mode; and output formats Text, Hex, Hex (uppercase), Hexdump, and Bytes summary. Common uses: reading encoded query strings, fixing %2520 double-encoding, diagnosing garbled text (charset mismatch), and inspecting raw bytes.

### URL Encoder (/encode.html)
Percent-encodes text. Four variants: Standard (encodeURIComponent equivalent), Strict (RFC 3986 unreserved only), Form (space → +), and Path-aware (preserves / separators). Options: encode each line separately (batch), MIME-style 76-character wrapping, and LF/CRLF newline control. Common uses: encoding a single query value or path segment, building form bodies, and producing strict RFC 3986 output for OAuth or AWS signatures.

### Query String Parser (/tools/query-string-parser.html)
Takes a full URL or a bare query string and splits it into its key/value pairs, showing each parameter's key, decoded value, and original raw value in a table. Handles duplicate keys (e.g. tags=a&tags=b) as separate rows, distinguishes + from %20, and decodes percent-encoded keys and values. Common uses: inspecting UTM and tracking parameters, debugging API query strings, and seeing exactly how a link's parameters are structured. Split ownership per standards: only the ? delimiter is defined by RFC 3986 §3.4; the key=value&key=value convention is the WHATWG URL Standard.

### URL Parser (/tools/url-parser.html)
Breaks a complete URL into its components using the browser's native URL API: protocol (scheme), username/password (userinfo), hostname, port, pathname, search (query), hash (fragment), and origin. Shows each part both raw and decoded, and lists query parameters separately. Handles credentials (user:password@host), explicit ports, IPv6 hosts, and relative-vs-absolute resolution against a base URL. Standards: RFC 3986 §3.2 (authority), §5 (reference resolution), and the WHATWG URL Standard.

### Form Encoder (/tools/form-encoder.html)
Builds an application/x-www-form-urlencoded body from key/value pairs, producing both the encoded form body and a ready-to-run cURL command. In this format a space becomes + (not %20), and reserved characters in keys and values are percent-encoded. Common uses: constructing POST bodies, testing form submissions, and generating OAuth token-endpoint requests (which are form-urlencoded). Standards: the WHATWG URL Standard defines x-www-form-urlencoded; RFC 7578 defines the related multipart/form-data used for file uploads.

### Path Encoder (/tools/path-encoder.html)
Slash-aware path encoding: splits a path at its / separators and encodes each segment independently, so structural slashes stay literal while spaces and special characters inside segments are percent-encoded (space → %20, not +). Prevents the common bug where a generic encoder turns /api/users into api%2Fusers and breaks routing. Also covers sub-delimiters for matrix parameters and the hyphen-vs-underscore SEO distinction. Standards: RFC 3986 §3.3 (path), §2.3 (unreserved), §2.2 (sub-delimiters), RFC 3629 (UTF-8).

### URL Validator (/tools/url-validator.html)
Checks whether a string is a well-formed URL and, if not, explains why, using the same native URL parsing your code would use (URL.canParse / new URL in a try/catch). Returns a clear valid/invalid verdict with a component breakdown for valid URLs. More reliable than regex-based validation, which tends to reject valid URLs (IPv6 hosts, internationalized domains, unusual ports) or accept broken ones. Standards: RFC 3986 §3 and the WHATWG URL Standard.

### URL Builder (/tools/url-builder.html)
Constructs a URL from individual parts — protocol, host, port, path, query parameters, and fragment — assembling them with correct delimiters (one ?, subsequent parameters joined with &, fragment last). A generic key/value builder; UTM campaign links are one common use case. Standards: RFC 3986 §3.4 (query), §3.5 (fragment), and the WHATWG URL Standard.

## Key concepts covered

- The difference between %20 and +: %20 works everywhere; + means space only in form-encoded query strings (application/x-www-form-urlencoded). In a path, + is a literal plus.
- encodeURIComponent vs encodeURI: use encodeURIComponent for a single value (query param, path segment, fragment); encodeURI only for a complete URL where structural characters must be preserved.
- Double-encoding: encoding an already-encoded string turns %20 into %2520 (the % becomes %25). Fix by decoding recursively; prevent by encoding raw input exactly once at the request boundary.
- Character-set mismatch: garbled output (e.g. café instead of café) means the bytes were encoded in one charset and decoded with another. Fix by selecting the correct source charset.
- Reserved vs unreserved characters: unreserved (A–Z a–z 0–9 - _ . ~) never need encoding; reserved characters must be encoded when used as data rather than as delimiters.
- Hex casing: %3A and %3a are equivalent per RFC 3986 but crawlers treat them as distinct URLs, splitting link equity — normalize to one case.
- URL length: no limit in the HTTP standard, but practical server limits apply (Apache ~8,190 bytes, Nginx 4 8k buffers). Over-long URLs return 414 (or 400 on Nginx) or 431.
- URL encoding is not encryption, not HTML encoding, and not Base64: each solves a different problem.

## Language-specific encoding

- Python: urllib.parse — quote() (path, %20), quote_plus() / urlencode() (form, +), unquote() / unquote_plus().
- JavaScript: encodeURIComponent (values), encodeURI (whole URLs), URLSearchParams (query strings, encodes once). Avoid the deprecated escape().
- Java: java.net.URLEncoder.encode(value, StandardCharsets.UTF_8) — form convention (+); always specify the charset.
- Go: net/url — QueryEscape (+ for space), PathEscape (%20); check the error from QueryUnescape.
- PHP: rawurlencode (RFC 3986, %20) vs urlencode (form, +); http_build_query for query strings.
- C#/.NET: Uri.EscapeDataString (RFC 3986) for new code; avoid legacy HttpUtility.UrlEncode (form, +).
- cURL: --data-urlencode encodes values; combine with -G for GET; always quote URLs in the shell.

## Contact

Questions or corrections: contactus@urlencodedecode.com