URLs and development
URL encoding: components, complete URLs, and double encoding
Choose component or full URL encoding, preserve query values containing ampersands and plus signs, and diagnose percent signs that have been encoded twice.
Published by qwertywelch.com
The right encoding depends on where the text will go. A search phrase is a parameter value; a complete address contains separators that give its parts meaning. Choosing the wrong operation can turn part of your search phrase into another parameter or turn an address into an unusable string.
The URL Encoder/Decoder offers Component and Full URL modes. Component uses JavaScript's encodeURIComponent and decodeURIComponent. Full URL uses encodeURI and decodeURI. Choose the mode from the input's role before pressing Encode or Decode.
Encode a query parameter value as a component
Suppose the search phrase is tea & biscuits + café. The ampersand and plus sign belong to that phrase. Encoding the value with Component mode protects those characters before the value is placed after q=. The accented letter is represented using percent-encoded UTF-8 bytes.
- Select Component and paste only the search phrase from the example.
- Press Encode. Check that the ampersand becomes %26 and the literal plus becomes %2B.
- Place the output after https://example.com/search?q= without encoding the assembled address again.
- Decode the component once and compare it with the original phrase, including its spaces and accent.
Input
tea & biscuits + caféExpected result
tea%20%26%20biscuits%20%2B%20caf%C3%A9Use Full URL mode only when the separators are intentional
Full URL mode preserves characters such as the colon, slashes, question mark, ampersand, and hash that can structure an address. For a simple address with an unencoded space in its path, this keeps the address recognizable while encoding the space.
It cannot decide whether an ampersand belongs inside a search phrase or separates parameters. Do not paste a full address containing an unescaped value such as q=tea & biscuits and expect Full URL mode to resolve that ambiguity. Encode each value before assembling the address, or use a URL-building API.
A complete URL can itself be a parameter value, such as a return address. In that case its role is still a component: encode the entire inner URL as the outer parameter's value. Decide which URL you are constructing and which text is its data.
Input
https://example.com/my notes?view=full#introExpected result
https://example.com/my%20notes?view=full#introDistinguish a space from a literal plus sign
Component mode represents a space as %20. Form-style query serialization, including URLSearchParams, commonly represents it as +. Both forms need to be interpreted using the rules of the receiving format. A literal plus in a form-style query value should be encoded as %2B.
This tool's Component decoder calls decodeURIComponent directly; it does not replace + with a space. If you paste tea+biscuits, the plus remains. For a complete query string from a form, use a query parser such as URLSearchParams rather than assuming the component decoder implements form decoding.
When building URLs in JavaScript, pass raw parameter values to searchParams.set. Supplying a value you already percent-encoded makes the API encode its percent signs again. Choose one place in the process to serialize each parameter.
Diagnose double encoding without guessing
Encoding an already encoded space changes %20 to %2520 because the percent sign becomes %25. Decoding once returns %20, not a space. That is a useful clue, but %25 is not automatically a mistake: the original value may contain a literal percent sign or an intentionally nested encoded value.
Keep the received value and trace the steps that produced it. Identify the stage that owns each decode operation. Avoid repeatedly pressing Decode until the result looks readable; an additional decode can change data into separators with a different meaning.
The tool's detection label only checks whether the input contains a percent sign followed by two hexadecimal digits. It cannot establish that the whole input is valid, which format produced it, or how many times it was encoded.
Check the resulting values at the destination
For the worked example, inspect the assembled URL with a query parser and confirm q equals the original phrase. Compare parameter names and values rather than only the address bar's appearance, since browsers may display some encoded characters in readable form.
- Check the hostname and path, then confirm no extra parameters appeared from an unescaped ampersand.
- Component decoding can fail on malformed percent escapes or invalid encoded UTF-8. Check the original value instead of deleting percent signs.
- Full URL decoding intentionally keeps some encoded reserved characters intact. Use Component decoding when inspecting an individual value.
- Percent encoding is reversible formatting. It does not encrypt a value or make an untrusted destination safe.
Try the tools
Start with the sample above. Keep an unchanged copy of your own data before converting it.
References and corrections
- ECMAScript: URI encoding and decoding functions
- WHATWG URL Standard: URLSearchParams and form encoding
- RFC 3986: when to encode or decode
Found a result that differs from this guide? Send a correction with a small, non-sensitive example and your expected result.