URL Encoder

1. 1Paste the URL or the value you want to encode.
2. 2Choose the mode: full URL, or a single component.
3. 3Copy the encoded result.
4. 4Switch to component mode if you are building a query string.

There are two different jobs here and using the wrong one is the classic URL bug. Encoding a full URL must leave the structural characters alone — the :// , the / between path segments, the ? and the & — or the URL stops being a URL. Encoding a single parameter value must escape those same characters, or a value containing & will be read as the start of another parameter.

So encoding https://example.com/a b as a full URL gives https://example.com/a%20b, with the slashes intact. Encoding the same string as a component escapes everything: https%3A%2F%2Fexample.com%2Fa%20b — which is exactly right when that URL is being passed as a redirect parameter.

Percent-encoding writes each disallowed byte as % followed by two hex digits. Non-ASCII characters are converted to UTF-8 first, so a single character can become several escapes: é becomes %C3%A9.

Spaces have two encodings. In a path a space is %20; in a query string, + is also accepted by most servers as a legacy convention. %20 is always safe.

Everything runs in this page. Nothing you paste is transmitted, logged or stored, which is what makes it safe to drop a production payload in here while you are debugging.

• Use component mode for a single query parameter value; full-URL mode would leave & and = unescaped.
• Encode values once. Encoding an already encoded string turns % into %25 and breaks it.
• Use component mode when passing a whole URL as a parameter, such as a redirect address.
• Use %20 for spaces when unsure; it is valid everywhere.

• UTM parameters explained: how to see which links bring you visitors
• What is Base64, and when should you use it?
• URL encoding explained: what %20 means and when to encode
• URL query parameters explained: what comes after the ?
• Why a link breaks when you paste it into an email, chat or document