什么是 URL 编码 / 解码器？
URL encoding (percent-encoding) converts characters that are unsafe in URLs into a format that can be transmitted over the internet. Spaces become %20, forward slashes become %2F, and characters like &, =, and ? that carry structural meaning in URLs are encoded so they are treated as literal data rather than URL structure. Our URL Encoder and Decoder converts in both directions instantly.
Every URL containing non-ASCII characters, spaces, or special symbols must be percent-encoded before transmission. Unencoded URLs are technically malformed and may be misinterpreted by servers, proxies, and browsers. Conversely, reading encoded URLs in developer tools, log files, or API documentation requires decoding to understand the actual content.
URL encoding is governed by RFC 3986. The unreserved characters — letters, digits, and - _ . ~ — transmit as-is. Everything else, including spaces, Unicode characters, and special punctuation, must be encoded. The specific encoding requirements differ for URL paths, query string values, and fragment identifiers.
使用场景
以下是人们每天使用 URL 编码 / 解码器 的最常见场景。
Query String Parameter Encoding
When building URLs with user-provided search parameters, special characters must be encoded. A search for "C# & .NET" becomes ?q=C%23%20%26%20.NET. An email in a parameter needs the @ encoded as %40 to prevent it being misinterpreted as a userinfo separator. Our encoder applies encodeURIComponent() semantics — the correct function for encoding individual query values in JavaScript.
API URL Construction
Constructing API calls with parameters containing spaces, international characters, or special symbols requires encoding. A search API call with Japanese text or special characters encodes correctly with our tool, preventing hard-to-diagnose 400 Bad Request errors caused by unencoded characters in URL construction.
Decoding URLs from Logs
Server logs, analytics platforms, and error trackers store URLs in encoded form. Decoding makes content readable: %22 becomes ", %3C becomes <. When analyzing user search queries or diagnosing 404 errors, decoding reveals actual user intent rather than percent-encoded strings.
Internationalized URLs
URLs with non-ASCII characters must be encoded as their UTF-8 byte sequences. Japanese "東京" encodes to %E6%9D%B1%E4%BA%AC. Modern browsers display the decoded form in the address bar but transmit the encoded form. Our encoder handles the full Unicode range correctly.
OAuth and API Token Handling
OAuth redirect URIs, authorization codes, and state parameters frequently contain characters that need encoding when included as query parameters. A redirect_uri that itself contains query parameters must be encoded: https://example.com/callback?state=xyz becomes https%3A%2F%2Fexample.com%2Fcallback%3Fstate%3Dxyz when used as a parameter value.
Webhook and Callback URL Construction
When registering webhook URLs with third-party services like Stripe, Twilio, or GitHub, the callback URL must be a valid, properly encoded URL. If your callback URL contains query parameters for routing or security tokens, those parameters must be percent-encoded before being included in the registration request. Our encoder handles the full URL encoding correctly so webhook deliveries reach the right endpoint without 400 errors from malformed URLs.
示例
Encode Search Query
Encode a special-character query for a URL parameter.
C# programming & .NET C%23%20programming%20%26%20.NET Decode from Logs
Decode an encoded URL path from server access logs to understand actual user intent.
/search%3Fq%3Dhello%20world%26lang%3Den /search?q=hello world&lang=en Encode a Redirect URI for OAuth
Encode a callback URL that itself contains query parameters so it can be safely passed as a redirect_uri parameter.
https://myapp.com/callback?env=production&version=2 https%3A%2F%2Fmyapp.com%2Fcallback%3Fenv%3Dproduction%26version%3D2 URL 编码 / 解码器 对比 Browser Address Bar
Dedicated URL encoder versus relying on the browser to handle encoding.
| 功能 | Toolorah | Browser Address Bar |
|---|---|---|
| Encodes specific components | Yes — precise control | Encodes the whole URL with its own rules |
| Shows raw percent-encoded output | Yes — copy exact string | Hides encoding in display |
| Decodes encoded strings | Yes | Only displays decoded form |
| Handles encodeURI vs encodeURIComponent distinction | Yes — both modes | No control |
| Works offline | Yes | Yes |
| Useful for constructing API calls | Yes | No |
| No browser navigation needed | Yes | Must use address bar |
URL 编码 / 解码器 使用技巧
- Use encodeURIComponent() for query values; encodeURI() for full URLs (it does not encode : / ? # & =).
- Spaces encode as %20 (RFC 3986) or + (form encoding). + in path segments is a literal plus, not a space.
- The @ in email addresses must be encoded as %40 in URL query parameters.
- Double-encoding (%20 → %2520) is a common bug — always encode raw values, never already-encoded strings.
- Safe characters needing no encoding: A-Z, a-z, 0-9, and - _ . ~
常见问题解答
What is the difference between encodeURI and encodeURIComponent?
encodeURI() encodes a complete URL and deliberately leaves URL structural characters intact: : / ? # [ ] @ ! $ & ' ( ) * + , ; =. encodeURIComponent() encodes a URL component (path segment or query value) and encodes all characters except letters, digits, and - _ . ~. Use encodeURIComponent() for individual parameter values and encodeURI() when normalizing a full URL. Never use encodeURI() on a query parameter value — the & and = will not be encoded and will corrupt the URL structure.
Why does space encode as + sometimes and %20 other times?
+ for space is used in the application/x-www-form-urlencoded format — the format used by HTML form submissions. RFC 3986 percent-encoding always uses %20 for space. In URL query strings, + is treated as space by most web servers because query strings were historically form-encoded. However, + in a URL path is a literal plus sign, not a space. Using %20 universally is safer and avoids this ambiguity, though + in query strings is accepted by virtually all web servers.
What characters must be percent-encoded in a URL?
RFC 3986 defines unreserved characters that need no encoding: A-Z, a-z, 0-9, and - _ . ~. All other characters must be encoded including: space (%20), ! (%21), # (%23), $ (%24), & (%26), / (%2F), : (%3A), = (%3D), ? (%3F), @ (%40), and all non-ASCII Unicode characters encoded as UTF-8 bytes. Reserved characters have special URL structural meaning and must be encoded when used as literal data values.
How are non-ASCII characters encoded in URLs?
Non-ASCII characters (Unicode beyond ASCII 127) are first encoded as UTF-8 bytes, then each byte is percent-encoded. The Japanese character 東 (U+6771) encodes as UTF-8 bytes E6 9D B1, which becomes %E6%9D%B1 in the URL. This process handles all Unicode correctly including emoji: 🎉 (U+1F389) encodes as %F0%9F%8E%89. Modern browsers handle this transparently — they display the decoded character in the address bar but transmit the percent-encoded version to servers.
What is IDN and how does it relate to URL encoding?
IDN (Internationalized Domain Names) allows domain names to contain non-ASCII characters. Since the DNS system only supports ASCII, IDN domains are encoded using Punycode — a separate encoding from percent-encoding used for URL paths and query strings. The Arabic domain مثال.إختبار converts to the Punycode equivalent xn--mgbh0fb.xn--kgbechtv for DNS resolution. Browsers display the decoded Unicode domain in the address bar but use the Punycode version for DNS queries. Our URL encoder handles path and query encoding; Punycode encoding of domain names is a separate operation.
What is the maximum length of a URL?
There is no universal URL length limit defined by RFC 3986. Practical limits come from browsers and servers: Chrome supports URLs up to approximately 2MB; Internet Explorer had a 2,048-character limit. Most web servers (Apache, nginx) have configurable limits but default to 8,192 bytes. CDNs and proxies may have their own limits. The safe practical limit for URLs in forms and links is under 2,000 characters. If you need to transmit large amounts of data, use POST request body parameters rather than URL query strings.
Can URL encoding be used to bypass security filters?
Historically, some web application firewalls and input validators were bypassed using double-encoding or non-standard encoding. For example, %252F (double-encoded slash) might bypass a filter checking for %2F. Modern security controls decode URLs before checking, making this less effective, but misconfigured validators remain vulnerable. For security-critical applications, always decode and normalize URLs completely before any security checking, and never apply security rules to raw encoded strings. This is a known attack class in the OWASP Web Security Testing Guide.