Why URLs need encoding
The URL specification (RFC 3986) defines a limited set of characters that are safe to use in a URL without encoding. Letters, digits, and a handful of symbols (-_.~) are safe. Everything else must be percent-encoded.
A space, for example, must become %20. An @ sign becomes %40. An ampersand (&) is used as a query parameter separator, so if you want a literal & in a parameter value, it must be encoded as %26.
Without encoding, URLs break or behave unexpectedly. A URL with an unencoded space might be truncated at the space. An unencoded & in a parameter value would be misread as a parameter separator by the server.
- Space → %20
- & → %26
- = → %3D
- / → %2F
- ? → %3F
- # → %23
- + → %2B
- @ → %40
encodeURIComponent vs encodeURI — what's the difference
JavaScript provides two encoding functions. encodeURI() is designed for encoding a complete URL — it leaves characters like /, ?, &, and # alone because they have structural meaning in a URL. encodeURIComponent() encodes everything except letters, digits, and -_.!~*'(), making it suitable for encoding individual query parameter values.
In practice, use encodeURIComponent() when building query strings from user input. Use encodeURI() when you have a complete URL that you want to make safe without breaking its structure.
The Irreva URL Encoder lets you choose between both modes. For most use cases — encoding a search query or form value — encodeURIComponent is the right choice.
Decoding URLs — reading percent-encoded strings
Decoding converts percent-encoded sequences back to their original characters. This is useful when reading a URL from a log file, debugging a redirect chain, or understanding what parameters a URL contains.
A URL like https://example.com/search?q=hello%20world&lang=en is more readable as https://example.com/search?q=hello world&lang=en after decoding. The tool handles both full URLs and isolated query strings.
Be careful when decoding URLs from untrusted sources and then using the decoded values in HTML or SQL — decoded user input can contain characters that need separate sanitization to prevent injection attacks.