URL Encoder & Decoder — RFC 3986 Percent-Encoding Technical Guide
Encode and decode URLs using RFC 3986 percent-encoding with support for full URL encoding, component encoding, and query string parameter encoding.
01. URL Percent-Encoding: RFC 3986 Reserved & Unreserved Characters
URL percent-encoding, defined in RFC 3986, replaces unsafe or reserved characters with a percent sign followed by two hexadecimal digits representing the character UTF-8 byte value. The unreserved characters (A-Z, a-z, 0-9, -, _, ., ~) are never encoded. All other characters must be percent-encoded when they appear in a URI component where their literal meaning would be ambiguous.
RFC 3986 defines two categories of reserved characters: gen-delims (: / ? # [ ] @) which delimit major URL components, and sub-delims (! $ & single-quote ( ) * + , ; =) which separate sub-components. These characters must be percent-encoded if they appear as data within a component.
The application/x-www-form-urlencoded format (used in HTML form submissions) differs slightly from RFC 3986: spaces are encoded as + (not %20), making it essential to distinguish which encoding scheme applies when parsing query parameters.
- RFC 3986 §2.3 Unreserved: A-Z, a-z, 0-9, -, _, ., ~ — never percent-encoded.
- RFC 3986 §2.2 gen-delims: : / ? # [ ] @ — encode as data inside components.
- Form encoding: space becomes + (not %20); & separates params; = separates key-value.
- encodeURIComponent encodes all except unreserved; encodeURI preserves URL structure.
02. JavaScript URL Encoding & Common Pitfalls
JavaScript provides built-in functions: encodeURI() encodes a full URL preserving structural characters. encodeURIComponent() encodes a URL component, replacing all characters except unreserved ones — the correct function for encoding query parameter values.
Double-encoding trap: if a value was already percent-encoded and encodeURIComponent is called again, the percent sign becomes %25, corrupting the URL. Always track whether a value has been encoded before applying encoding functions.
- encodeURIComponent(): Correct for query parameter values — encodes & + = and special chars.
- encodeURI(): For complete URL strings — preserves : / ? & = # structural characters.
- Double-encoding: Calling encode twice turns % into %25 — check if already encoded.
- Deprecated unescape(): Do not use — not Unicode-safe.
Frequently Asked Questions (FAQ)
What is the difference between encodeURI and encodeURIComponent?
encodeURI encodes a complete URL preserving structural characters. encodeURIComponent encodes a single component, encoding those structural characters too — use it for parameter values.
Why is %20 used for spaces in some cases and + in others?
RFC 3986 specifies %20 for spaces in URI components. HTML form encoding (application/x-www-form-urlencoded) uses + for spaces in query strings. Both are valid in their respective contexts.
Is my confidential data uploaded to external servers when using URL & Query String Encoder?
No. Core processing in URL & Query String Encoder executes in volatile browser memory without server uploads. Inputs to local tools are not logged on remote servers; optional cloud-assisted features require user consent.
Can I use URL & Query String Encoder offline without an active internet connection?
Offline use requires the page and its tool assets to finish caching first. Core transformations can then run locally; optional AI and contact delivery require internet.
Is URL & Query String Encoder free to use with any rate limits or paywalls?
Core tools are free to use without an account. Device memory and tool-specific safety limits apply. Optional AI and online contact services have usage limits.