URL Encoder / Decoder

URL encoding, also called percent-encoding, converts characters that are not allowed or have special meaning in a URL into a safe format. Each unsafe character is replaced by a percent sign (%) followed by two hexadecimal digits representing the character's UTF-8 byte value. For example, a space becomes %20, an ampersand becomes %26, and a forward slash becomes %2F. This ensures special characters in query parameters, path segments, or form data do not break the URL structure. The standard is defined in RFC 3986.

Both %20 and + represent a space, but they belong to different encoding standards. %20 (Standard / RFC 3986) is the universal percent-encoding for a space and is safe in any part of a URL — path, query, or fragment. + (Form encoding / application/x-www-form-urlencoded) is the HTML form submission standard: browsers encode form field values with space → + when submitted via GET or POST. The difference matters when you decode: a server expecting form encoding will turn + back into a space, but if you used %20 in a form field, + in that field would remain a literal plus sign (+). Use %20 in API query parameters; use form encoding only for HTML form submissions.

RFC 3986 defines unreserved characters that are always safe without encoding: letters A–Z and a–z, digits 0–9, hyphen (-), underscore (_), period (.), and tilde (~). Standard encodeURIComponent also leaves ! ~ * ' ( ) unencoded (they are safe in query parameter values but not in all URL contexts). Everything else — spaces, &, =, +, /, ?, #, @, %, non-ASCII Unicode — must be percent-encoded. When in doubt, use Full RFC 3986 mode which only passes through the 66 unreserved characters.

URL encoding is essential whenever you include user-supplied data or special characters in a URL. Without encoding, a query like ?name=Alice & Bob breaks the URL structure because & is the query parameter separator — the server would see two parameters instead of one. In REST APIs, URL-encoded parameters ensure the request reaches the server intact. In payment gateways like Razorpay, PayU, and PhonePe (common in India), HMAC-SHA256 signatures are computed over URL-encoded strings — a single unencoded character in the input produces a completely different signature and a rejected transaction. Correct URL encoding is also critical for OAuth tokens, JWT query parameters, and any redirect URL passed as a query value.