What characters need to be URL encoded?

Characters that must be percent-encoded in URLs include: Space ( ) becomes %20, Ampersand (&) becomes %26, Plus (+) becomes %2B, Equals (=) becomes %3D, Question mark (?) becomes %3F, Hash (#) becomes %23, Slash (/) becomes %2F, Colon (:) becomes %3A, At sign (@) becomes %40, and all non-ASCII characters including accented letters, Chinese characters, Arabic text, and emoji. Characters that do NOT need encoding are: letters A-Z and a-z, digits 0-9, and the characters hyphen (-), underscore (_), period (.), and tilde (~). Vicspot's free URL encoder handles all of these automatically.

Is there a difference between URL encoding and HTML encoding?

Yes — URL encoding and HTML encoding are completely different and serve different purposes. URL encoding (percent-encoding) uses % followed by hex codes to make strings safe in URLs. For example, & in a URL becomes %26. HTML encoding (HTML entities) uses & followed by a name or number and semicolon to make characters safe in HTML markup. For example, & in HTML becomes & and < becomes <. Use URL encoding for query strings, API parameters, and redirect URLs. Use HTML encoding for displaying content inside HTML documents and preventing XSS vulnerabilities. Vicspot provides separate free tools for URL encoding and HTML entity encoding.

URL Encoder / Decoder – Free Online Tool

Q: What is URL encoding and why is it needed?

URL encoding (also called percent-encoding) is the process of converting characters that are not allowed or have special meaning in URLs into a safe format. URLs can only contain a limited set of characters: letters (A-Z, a-z), digits (0-9), and a few special characters (-, _, ., ~). All other characters must be encoded as a percent sign (%) followed by their two-digit hexadecimal code. For example, a space becomes %20, an ampersand becomes %26, and a hash becomes %23. URL encoding is essential when passing data in query strings, form submissions, API requests, and redirect URLs to prevent the browser from misinterpreting the characters as URL structure.

Q: What is the difference between URL encode and URL decode?

URL encode converts a string into a percent-encoded format safe for use in URLs. For example, 'hello world&lang=en' becomes 'hello%20world%26lang%3Den'. URL decode does the reverse — it converts a percent-encoded string back to its original readable form. For example, 'hello%20world' becomes 'hello world'. Use URL encoding when building URLs programmatically, constructing API query parameters, or embedding data in redirect URLs. Use URL decoding when reading query parameters from incoming URLs, processing form submissions, or analyzing logged URL strings.

Q: How do I encode URL parameters for an API request?

When building API requests with query parameters, each parameter value must be URL-encoded to prevent characters like spaces, ampersands, and equals signs from breaking the URL structure. For example, if you have a search query 'hello world & more', it must be encoded as 'hello%20world%20%26%20more' before appending to your URL. To encode API parameters using Vicspot's free URL encoder: paste each parameter value (not the full URL) into the input box, click Encode URL, and copy the result. In programming, use encodeURIComponent() in JavaScript, urllib.parse.quote() in Python, or urlencode() in PHP to encode individual parameter values.

Q: What is the difference between encodeURI and encodeURIComponent?

In JavaScript, encodeURI() encodes a complete URL but leaves characters that are valid URL structure characters unencoded (like /, ?, =, &, #, :). It is used when you have a full URL that you want to make safe without breaking its structure. encodeURIComponent() encodes everything except letters, digits, and - _ . ~ — including /, ?, =, &, #, and :. It is used for encoding individual query parameter values, form field values, or any string that will be embedded as a component within a larger URL. Vicspot's URL encoder uses encodeURIComponent() logic, making it ideal for encoding individual parameter values and query strings.

Q: How do I encode a redirect URL that contains another URL?

When a URL contains another URL as a query parameter (such as a redirect_uri or return_url parameter), the inner URL must be fully percent-encoded so browsers and servers don't confuse its characters with the outer URL's structure. For example, the redirect URL https://example.com/callback?url=https://other.com/page?id=5 is invalid because the inner URL contains characters that break the outer URL. The correct approach is to encode the inner URL: first paste https://other.com/page?id=5 into Vicspot's URL encoder, click Encode URL, and use the result as the parameter value: https://example.com/callback?url=https%3A%2F%2Fother.com%2Fpage%3Fid%3D5

What is URL encoding and why is it needed?

URL encoding (percent-encoding) converts characters that are not URL-safe into a %XX hex format. URLs can only safely contain letters, digits, and a few symbols. All other characters must be encoded.

For example: a space becomes %20, an ampersand becomes %26, and a hash becomes %23. This prevents browsers from misinterpreting characters as URL structure when passing data in query strings, API requests, and redirect URLs.

What is the difference between URL encode and URL decode?

URL Encode — converts a plain string to percent-encoded format:

hello world&lang=en → hello%20world%26lang%3Den

URL Decode — converts a percent-encoded string back to readable form:

hello%20world%26lang%3Den → hello world&lang=en

Use encoding when building URLs. Use decoding when reading query parameters from incoming requests.

Which characters need to be URL encoded?

Characters that must be percent-encoded:

Space → %20
Ampersand & → %26
Plus + → %2B
Equals = → %3D
Question mark ? → %3F
Hash # → %23
Slash / → %2F
All non-ASCII characters (accented letters, emoji, Chinese, Arabic)

Characters that are safe and do NOT need encoding: A-Z a-z 0-9 - _ . ~

How do I encode URL parameters for an API request?

Each API query parameter value must be URL-encoded before appending to the URL. For example:

Search query: hello world & more

Encoded: hello%20world%20%26%20more

Final URL: https://api.example.com/search?q=hello%20world%20%26%20more

In code: use encodeURIComponent() in JavaScript, urllib.parse.quote() in Python, or urlencode() in PHP. Use this tool for quick manual encoding of API endpoint parameters.

What is the difference between encodeURI and encodeURIComponent?

In JavaScript, there are two encoding functions:

encodeURI() — encodes a full URL but keeps URL structure characters (/, ?, =, &, #) unencoded. Use for full URLs.
encodeURIComponent() — encodes everything including /, ?, =, &. Use for individual parameter values.

Vicspot's URL encoder uses encodeURIComponent() logic — ideal for encoding individual query parameter values and form data.

How do I encode a redirect URL that contains another URL?

When embedding a URL inside another URL as a parameter (e.g., redirect_uri, return_url), the inner URL must be fully percent-encoded:

❌ Invalid: https://app.com/auth?redirect=https://site.com/page?id=5
✅ Correct: https://app.com/auth?redirect=https%3A%2F%2Fsite.com%2Fpage%3Fid%3D5

Paste the inner URL (https://site.com/page?id=5) into the encoder above → click Encode URL → use the result as your redirect parameter value.

What is the difference between URL encoding and HTML encoding?

They are completely different and serve different purposes:

URL encoding — uses %XX hex codes for URL-safe strings. & → %26
HTML encoding — uses &name; entities for safe HTML markup. & → &

Use URL encoding for query strings and API parameters. Use HTML encoding for displaying content in HTML pages and preventing XSS. Vicspot provides separate free tools for both.

URL Encoder / Decoder