URL Encoder & Decoder
Percent-encode or decode URI components and full URLs locally with graceful malformed-sequence error reporting.
Local Workspace (url-codec)
How to Use URL Encoder & Decoder
- 1Choose Encode URL or Decode URL and select either URI Component (RFC 3986 Strict) or Full URL (Preserve Scheme & Path).
- 2Check the '+' space option when working with application/x-www-form-urlencoded HTML form query strings.
- 3Paste your parameter or URL into the input box, review any security notices, and copy or download the plain-text result.
Technical Specifications & Guardrails
- Strict RFC 3986 URI Component mode percent-encodes reserved sub-delimiters including !, ', (, ), and *
- Full URL mode preserves scheme (https://), host, path slashes, and query delimiters while escaping unsafe characters
- Bidirectional application/x-www-form-urlencoded '+' space conversion toggle
- XSS-safe plain-text output with automatic detection and warning for executable schemes (javascript:, data:, vbscript:)
Practical Example: Safely Encoding Complex Search Queries & Inspecting Suspicious Redirect URLs
- Sample Input
- A redirect query parameter containing nested ampersands, spaces, parentheses, or an obfuscated javascript%3A payload.
- Verified Local Output
- Percent-encoded strictly per RFC 3986 or decoded into a read-only plain-text box with an explicit security alert if an executable URI scheme is present.
Operational Limits & Browser Guardrails
Processes URL and query strings up to 5 MB locally. Decoded output is intentionally rendered inside a read-only plain-text <textarea> and never as a clickable HTML link to eliminate DOM XSS from javascript:, vbscript:, or data:text/html payloads.
Frequently Asked Questions
When should I use URI Component mode versus Full URL mode?
Use URI Component (RFC 3986 Strict) when encoding a single query parameter value that may contain '&', '=', '?', '/', or parentheses. Use Full URL mode when encoding an entire URL while keeping 'https://', '/', '?', and '&' delimiters intact.
Why does URL decoding output plain text instead of a clickable link?
Rendering untrusted decoded strings inside an HTML anchor href could execute dangerous schemes such as javascript: or data:text/html if clicked. Plain-text output with scheme detection keeps inspection completely safe.
Why does RFC 3986 Strict mode encode characters like '!' and '*' that JavaScript encodeURIComponent() leaves unencoded?
JavaScript's built-in encodeURIComponent() follows an older URI grammar and leaves !, ', (, ), and * unescaped. FetchToolKit's RFC 3986 Strict mode percent-encodes those five sub-delimiters (%21, %27, %28, %29, %2A) for strict OAuth, AWS Signature v4, and RFC 3986 compliance.