URL encode

What stays as it is?

Letters, digits and -, _, . and ~ stay readable, as the URL standard allows. Everything else is written as UTF-8 bytes in %XX form: a space is %20 and é is %C3%A9. That is slightly stricter than JavaScript's encodeURIComponent, which leaves ! ' ( ) * alone, so the result is always safe as a single query value.

Options

• Spaces as + gives the form encoding used by HTML forms (application/x-www-form-urlencoded).
• Encode every character, letters too turns everything into %XX, sometimes used to test or obscure a link.
• Encode each line separately keeps the line breaks, handy for a list of search terms.

To decode, use URL decode.

Encode a value, not a whole URL

Encode the parts that you insert into a URL, such as a search term or a redirect address, not the whole address. If you encode https://example.com/a?b=c, the :, / and ? become codes too and the link no longer works. In JavaScript, encodeURIComponent is meant for values and encodeURI for a complete address; this tool does what encodeURIComponent does, slightly stricter.

Path or query?

In a query string, a space is written as %20 or, in form data, as +. In a path, only %20 is right: a plus in a path is a real plus. Use the plus option only for form-style data.

A URL inside a URL

A redirect parameter such as ?next= should hold an encoded address, so its own ? and & do not split your parameters. Encode the inner URL once; encoding twice produces %253A and breaks it.

Beyond URLs

Do you have to put binary data or a file in text? Percent-encoding makes it three times longer for each non-ASCII byte; Base64 is usually a better choice. For files in a URL-safe form, see file to URL encoding.