Understand this tool
Encode URL components without breaking structure
- What the concept means
- Percent-encoding represents a byte in a URI component as “%” followed by two hexadecimal digits.
- Why it exists
- It protects delimiters and characters that cannot appear literally in a particular URI component.
- When to use it
- Use it on an individual component such as a query value, not blindly on an entire already-structured URL.
- What the result means—and does not mean
- The encoded text is a representation suitable for a selected context. It does not make a URL trustworthy, reachable, or safe from injection when components are assembled incorrectly.
URI syntax gives characters roles
RFC 3986 distinguishes unreserved characters, which can usually appear literally, from reserved characters such as “?”, “&”, “/”, and “#” that delimit URI structure. Encoding a delimiter can turn it into data; failing to encode data can accidentally turn it into syntax.
Non-ASCII text is normally converted to UTF-8 bytes before each relevant byte is percent-encoded. HTML form encoding is related but often uses “+” for spaces, which is not a universal rule for complete URLs.
Key concepts
Key concepts
- URI
- A standardized identifier syntax that includes URLs.
- Reserved character
- A character with a structural role in URI syntax.
- Unreserved character
- A letter, digit, hyphen, period, underscore, or tilde normally safe literally.
- Percent-encoding
- A percent sign followed by two hexadecimal byte digits.
- UTF-8
- The common byte encoding used before percent-encoding Unicode text.
- Form encoding
- A query-string convention that may encode spaces as plus signs.
Method or process
How the process works
URI syntax gives characters roles
RFC 3986 distinguishes unreserved characters, which can usually appear literally, from reserved characters such as “?”, “&”, “/”, and “#” that delimit URI structure. Encoding a delimiter can turn it into data; failing to encode data can accidentally turn it into syntax.
Non-ASCII text is normally converted to UTF-8 bytes before each relevant byte is percent-encoded. HTML form encoding is related but often uses “+” for spaces, which is not a universal rule for complete URLs.
Compare the concepts
Component encoding and full-URL handling
| Operation | Preserves delimiters? | Use |
|---|---|---|
| Encode a value | Delimiters inside data are escaped | Query parameter value |
| Encode a full URL as one value | All structure may be escaped | Only when embedding that URL inside another component |
Common mistakes
Common mistakes
- Encoding an entire URL when only one value needs encoding.
- Double-encoding an existing percent sequence.
- Confusing plus signs with spaces in every URI context.
Edge cases and limits
Edge cases and limits
- Malformed percent sequences cannot decode cleanly.
- International domain names use a separate domain-name mechanism.
- A decoded string can still contain unsafe application data.