What URL encoding changes
URLs use a defined set of characters for structure. A question mark starts a query, an ampersand separates parameters, an equals sign can separate a key from its value, and a hash introduces a fragment. When one of those characters belongs to the data rather than the structure, percent-encoding represents its UTF-8 bytes as percent signs followed by hexadecimal values.
For example, a space in a component becomes %20, while the accented character in a UTF-8 value becomes one or more percent triplets. Encoding prevents a value such as tea & cake from being misread as two query parameters. Decoding performs the reverse representation change; it does not validate whether the resulting link is trustworthy.
How to encode a URL component
- Identify the exact component you are encoding, such as one query value or path segment.
- Paste the raw text, not an already assembled URL containing intentional separators.
- Encode it and copy the escaped result into the correct position.
- Test the final URL in the receiving application with non-sensitive sample data.
Component encoding is usually the safe choice for user-provided keys and values. Encoding an entire URL as one component also escapes its colon, slashes, question mark, and ampersands, so it no longer works as a directly navigable address. Whole URLs are sometimes encoded intentionally when nested inside a redirect or share parameter, but only the outer parameter's value should receive that treatment.
How to decode an escaped value
- Paste the percent-encoded text or selected URL component.
- Decode once and inspect the result before attempting another pass.
- If the input uses form encoding, account for plus signs that may represent spaces.
- Do not automatically navigate to an unfamiliar decoded destination.
A malformed percent sequence, such as a percent sign without two hexadecimal digits, should produce an error rather than a guessed character. A decoding failure can also indicate truncated UTF-8 bytes. Preserve the original value while troubleshooting so you can compare exactly what the upstream system supplied.
Reserved characters and common traps
Percent encoding versus form encoding
HTML form query encoding often represents spaces as plus signs, while general URI component encoding uses %20. A literal plus in a form value therefore needs its own encoding as %2B. When a decoder turns plus into space unexpectedly, determine whether the source is an application/x-www-form-urlencoded form or an ordinary URL component.
Double encoding
If %20 becomes %2520, the percent sign was encoded a second time. Decode only at the application layer that owns the encoding and avoid repeated encode operations on values that may already be escaped. Security filters and backend frameworks often decode at different stages, so ambiguous multi-encoded input should be rejected instead of normalized repeatedly.
Practical use cases
Encode a search term before adding it to a query parameter, a filename before using it as one path segment, or a complete callback URL before placing it inside an OAuth-style parameter. Decode analytics links to inspect campaign values, investigate a malformed redirect, or read a copied query string. For structured work, prefer the platform's URL and URLSearchParams APIs because they preserve boundaries more reliably than string concatenation.
Encoding is not sanitization and does not make an untrusted destination safe. Applications must still validate allowed schemes and hosts, prevent open redirects, escape values for the output context, and avoid placing secrets in URLs. Query values can appear in browser history, server logs, screenshots, referrer data, and copied messages.
Privacy
Encoding and decoding run in your browser, so the submitted text does not need to leave your device. Avoid using real password-reset links, authorization codes, signed URLs, or customer identifiers anyway: clipboard history, browser extensions, and shared screens may expose them. The conversion removes no sensitive information; it only changes how characters are represented.