URL Encoder Decoder

Complete URL Encoding Guide

Deep dive into URL encoding principles and master character handling in web development

Basic Concepts

What is URL Encoding?

URL encoding (Percent Encoding) is a method to convert special characters to %XX format, ensuring URLs are correctly transmitted and parsed.

Example: Hello World! → Hello%20World!

Why Do We Need Encoding?

• URLs only allow ASCII character set
• Some characters have special meaning in URLs
• Avoid parsing ambiguity and errors
• Ensure cross-platform compatibility

Encoding Format

Format: %XX (two hexadecimal digits)

% + character's UTF-8 encoding

Example: Space(32) → %20

Character Categories

✅ Safe Characters (No Encoding Needed)

A-Z a-z 0-9 - _ . ~

These characters can be used directly in URLs

⚠️ Reserved Characters (Special Purpose)

: / ? # [ ] @ ! $ & ' ( ) * + , ; =

Need encoding in specific contexts

❌ Must Encode Characters

Spaces, Unicode, Special symbols, etc.

These characters must be percent-encoded

Practical Applications

🌐 Web Development

• HTTP request parameter encoding
• AJAX data transmission
• Form data submission
• REST API parameter handling

📱 Mobile Development

• Deep Link parameter encoding
• URL Scheme handling
• Share link generation
• Inter-app data transfer

🔧 System Integration

• OAuth redirect URLs
• Webhook parameter passing
• Third-party API calls
• Logging and monitoring data

Programming Language Implementation

JavaScript

Encode: encodeURIComponent(str)

Decode: decodeURIComponent(str)

Most commonly used method

Python

Encode: urllib.parse.quote(str)

Decode: urllib.parse.unquote(str)

Standard library support

Java

Encode: URLEncoder.encode(str, "UTF-8")

Decode: URLDecoder.decode(str, "UTF-8")

Encoding must be specified

PHP

Encode: urlencode($str)

Decode: urldecode($str)

Built-in functions

Go

Encode: url.QueryEscape(str)

Decode: url.QueryUnescape(str)

net/url package

C#

Encode: Uri.EscapeDataString(str)

Decode: Uri.UnescapeDataString(str)

.NET Framework

Character Encoding Reference Table

Character	Description	Encoded	Usage
	Space	%20	Most common encoded character
!	Exclamation	%21	Need encoding in query params
"	Quote	%22	String delimiter
#	Hash	%23	URL fragment identifier
$	Dollar	%24	Special character encoding
&	Ampersand	%26	Parameter separator
'	Apostrophe	%27	String quoting
+	Plus	%2B	Space in form data
,	Comma	%2C	List separator
/	Slash	%2F	Path separator
:	Colon	%3A	Protocol and port separator
=	Equals	%3D	Key-value separator
?	Question	%3F	Query string start
@	At	%40	User info separator

Best Practices & Common Mistakes

✅ Best Practices

Choose Proper Encoding Method

Use encodeURIComponent for query params

Consistent Character Encoding

Use UTF-8 encoding throughout

Encode/Decode at Right Time

Convert at data boundaries

Validate Input Data

Verify encoding result validity

❌ Common Mistakes

Double Encoding

Avoid re-encoding already encoded content

Wrong Encoding Method

Distinguish encodeURI vs encodeURIComponent

Forgetting to Decode

Remember to decode when receiving data

Charset Mismatch

Ensure consistent charset in frontend/backend

Security Considerations

🔒 XSS Protection

• Encode JavaScript code
• Filter script tags
• Validate URL parameters
• Use CSP headers

🛡️ Injection Attacks

• Parameterized queries
• Input validation whitelist
• Length limit checks
• SQL injection protection

🚫 Data Exposure

• Encode sensitive info
• Avoid plaintext transmission
• Filter log information
• Use HTTPS protocol