Security
URL Encoder & Decoder
Convert special characters to percent-encoded hex sequences (%20) and decode URI strings.
Encode the Value, Not the URL
The most common failure is encoding an entire URL, which turns the structural "/" and ":" into %2F and %3A and destroys the address. Each query parameter value should be encoded individually before being placed into the URL; the separators themselves must survive untouched.
The reserved characters that need encoding in values: space (as %20, or + in the legacy form encoding), "&" (which otherwise starts the next parameter), "=" (which otherwise splits key and value), "#" (which otherwise jumps to a fragment), and "+" itself when a literal plus is meant.
Which Characters Actually Need Encoding
Percent-encoding replaces an unsafe byte with a percent sign and two hex digits, so a space becomes %20 and an ampersand becomes %26. Letters, digits and the characters - _ . ~ are safe anywhere in a URL. Reserved characters such as ? & = # and / have a job in the URL structure, so they must be encoded only when they appear as data, for example inside a query value.
The most common mistake is encoding an entire URL, which turns the colons and slashes into %3A and %2F and breaks it. Encode the individual values you insert, not the finished address. Non-ASCII text is first converted to UTF-8 bytes, so a single accented letter can become two encoded bytes such as %C3%A9.
How It Generates Output
- Encodes non-ASCII or reserved characters into percent-encoded UTF-8 hex pairs.
Example Output
Common Questions
encodeURI vs encodeURIComponent?
encodeURI preserves delimiters like "://". encodeURIComponent encodes all characters for parameter values.
Does the encoder handle non-ASCII characters?
Yes. Characters like "é" or emojis are first UTF-8 encoded and then percent-encoded (é becomes %C3%A9), which guarantees round-trip accuracy with any modern server.
Related Security
Base64 Encoder & Decoder
Encode or decode text to Base64 ASCII strings with full multi-byte Unicode UTF-8 handling.
Cryptographic Hash Generator
Compute secure cryptographic message digests client-side using native window.crypto.subtle and pure JS MD5 with legacy safety indicators.
Secure Password Generator
Generate cryptographically secure passwords locally via crypto.getRandomValues() with accurate real-time entropy scoring and zero server transmissions.