URL Encoder/Decoder - Encode Special Characters
Encode and decode URLs with special characters using percent-encoding (also called URL encoding). Our free URL encoder ensures that URLs with spaces, symbols, and international characters are transmitted safely across the web.
What is URL Encoding?
URL encoding, also known as percent-encoding, converts characters into a format that can be transmitted over the Internet. Special characters are replaced with a percent sign (%) followed by two hexadecimal digits representing the character's ASCII code. For example, a space becomes %20.
Why URL Encoding is Necessary
URLs can only contain a limited set of characters from the ASCII character set. Special characters, spaces, and non-ASCII characters must be encoded to:
- Prevent conflicts with URL syntax (?, &, =, etc.)
- Ensure safe transmission across different systems
- Support international characters (UTF-8)
- Avoid misinterpretation by web servers and browsers
Common Characters That Need Encoding
- Space: %20 or + (in query strings)
- ! (exclamation): %21
- # (hash): %23
- $ (dollar): %24
- % (percent): %25
- & (ampersand): %26
- + (plus): %2B
- = (equals): %3D
- ? (question): %3F
- @ (at): %40
URL Parts and Encoding Rules
- Scheme (http://): Not encoded, ASCII only
- Host (example.com): Uses Punycode for international domains
- Path (/path/to/page): Encode special characters except / : @ ! $ & ' ( ) * + , ; =
- Query String (?key=value): Encode all except - _ . ~ for keys and values
- Fragment (#section): Same rules as query strings
URL Encoding vs URI Encoding
URL Encoding (encodeURIComponent): Encodes almost everything except: A-Z a-z 0-9 - _ . ! ~ * ' ( )
URI Encoding (encodeURI): Preserves URI structure characters like : / ? # [ ] @ ! $ & ' ( ) * + , ; =
Use encodeURIComponent for query parameters and encodeURI for complete URLs.
Common URL Encoding Mistakes
- Encoding the entire URL including scheme and domain
- Not encoding spaces in query parameters
- Double-encoding (encoding already-encoded text)
- Using + for spaces in URL paths (only valid in query strings)
- Forgetting to encode user-provided data in URLs
Best Practices
- Always encode user input before adding to URLs
- Use built-in encoding functions in your programming language
- Encode query parameter values individually
- Decode URLs before displaying them to users
- Test URLs with special characters (especially &, =, ?, #)
- Use UTF-8 encoding for international characters
URL Encoding in Programming
- JavaScript: encodeURIComponent(), encodeURI(), decodeURIComponent()
- Python: urllib.parse.quote(), urllib.parse.unquote()
- PHP: urlencode(), rawurlencode(), urldecode()
- Java: URLEncoder.encode(), URLDecoder.decode()
- C#: Uri.EscapeDataString(), Uri.UnescapeDataString()
Security Considerations
Always encode user input to prevent URL injection attacks. Unencoded special characters can be exploited to manipulate query strings, break URL parsing, or inject malicious parameters. Server-side validation should always decode and validate URL parameters before use.