A parameter value containing reserved characters
Input
a+b=c d
Result
a%2Bb%3Dc%20d
The plus sign is escaped because many form parsers read a literal + as a space. The = would otherwise be read as a parameter separator.
Encoding Tools
URL Encoder
Encode URLs safely for redirects, query parameters, and API requests.
Encoded output
https%3A%2F%2Fsoftkey-tools.local%2Fsearch%3Fq%3Dangular%20tools%26mode%3Dphase%201
Understand the format
How URL Encoder works
Percent-encoding replaces characters that have structural meaning in a URL with a % followed by their byte value in hexadecimal, so data cannot be mistaken for syntax.
Reserved, unreserved, and everything else
RFC 3986 divides characters into three groups. Unreserved characters, which are A-Z, a-z, 0-9, hyphen, period, underscore, and tilde, never need encoding. Reserved characters such as ? & = # / : have structural meaning: they separate the query from the path, one parameter from the next, and the fragment from everything else. Any other character, including spaces and every non-ASCII character, must be percent-encoded.
The encoding itself is mechanical. The character is converted to bytes using UTF-8, and each byte becomes a percent sign followed by two hexadecimal digits. A space becomes %20, an ampersand becomes %26, and the euro sign, being three bytes in UTF-8, becomes %E2%82%AC.
Component encoding versus whole-URL encoding
This tool performs component encoding, the equivalent of encodeURIComponent. It escapes reserved characters too, which is exactly what you want for a single parameter value, and exactly what you do not want for a complete URL. Encode "https://example.com" as a component and the slashes and colon are escaped, which is correct when that URL is being carried inside another URL as a redirect target.
So the rule is about position, not about the string: encode each value as you place it into a query string, and never encode the URL you are building at the end. Getting this backwards produces the two classic failures, a broken link or a double-encoded one.
Step by step
How to use URL Encoder
- Paste only the value that needs escaping, such as a single query parameter or a redirect target.
- Copy the encoded output and place it after the = in your query string.
- Leave the separators of the outer URL unencoded: the ? before the query and the & between parameters.
- Test the assembled URL in the real integration to confirm the values arrive intact.
Encoding is performed by the browser encodeURIComponent function in the page, so callback URLs containing internal hostnames never leave your machine.
Worked examples
URL Encoder examples explained
A redirect target carried inside another URL
Input
https://ex.com/p?q=a b&r=1#top
Result
https%3A%2F%2Fex.com%2Fp%3Fq%3Da%20b%26r%3D1%23top
Correct when this value is assigned to something like ?next=. The whole thing is now one opaque parameter value rather than several parameters.
Reference
Characters that most often need encoding
| Character | Encoded | Why it matters in a URL |
|---|---|---|
| space | %20 | Terminates the URL in many parsers and breaks HTTP request lines. |
| & | %26 | Separates query parameters, so an unescaped & splits one value into two. |
| = | %3D | Separates a parameter name from its value. |
| ? | %3F | Starts the query string. |
| # | %23 | Starts the fragment; everything after it is never sent to the server. |
| / | %2F | Path separator. Must be escaped inside a value, left alone in the URL itself. |
| + | %2B | Read as a space by form-encoded parsers, which silently corrupts values. |
| % | %25 | Begins an escape sequence, so a literal percent must itself be escaped. |
Practical Guide
How teams use URL Encoder
Common use cases
- Prepare redirect and return-to URLs for authentication flows.
- Escape query parameter values before pasting reproduction steps into a ticket.
- Stop reserved characters in user input from breaking a generated link.
Checks before trusting the result
- Encode the segment that needs escaping, not the finished URL.
- Confirm whether the backend expects path encoding, query encoding, or a fully encoded callback.
- Verify the round trip in the real integration rather than by eye.
Troubleshooting
Common mistakes and how to fix them
- Double encoding, where %20 becomes %2520.
- A literal % is escaped as %25, so encoding an already-encoded value nests the escapes. Encode exactly once, at the point the value is inserted.
- Encoding the entire URL before making a request.
- The scheme, host, and separators must stay unescaped or the request has no valid target.
- Leaving a + in a value and finding it becomes a space.
- In application/x-www-form-urlencoded content, + means space. Escape it as %2B whenever the literal character matters.
FAQ
URL Encoder questions, answered
What is the difference between encodeURI and encodeURIComponent?
encodeURI keeps the characters that make a URL work, so it is for whole URLs. encodeURIComponent escapes reserved characters as well, so it is for individual values. This tool behaves like encodeURIComponent.
Should a space be %20 or +?
%20 is correct everywhere in a URI. The + form is specific to form-encoded bodies and query strings produced by HTML forms. When in doubt, use %20.
Do non-ASCII characters work in URLs?
They must be encoded as UTF-8 bytes first. Browsers display the readable form but transmit the percent-encoded bytes.
Why does my URL work in a browser but fail from a script?
Browsers quietly repair some malformed URLs, for example escaping spaces for you. HTTP clients and servers generally do not, which exposes the encoding bug.
Does encoding a URL make it safe?
No. It preserves structure, nothing more. Open-redirect and injection risks still require validating the destination and escaping output correctly in the receiving context.
Go deeper
Specifications and guides
- Base64, Hex, and Percent-Encoding Compared — Three encodings, three jobs. How to tell them apart, when each is correct, and why none of them protects data.