Browser 106

no file limit

Inspector security/url-encode

URL Coderen

Overview

URL Encode rewrites text as percent-escapes so it can be carried inside a URL, a query string or a request body. It offers three modes rather than one, because a single rule does not fit all three jobs: escaping a whole address the way a query value must be escaped destroys it, and escaping a query value the way an address is escaped leaves an & that ends the parameter early. Whole URL keeps the scheme, the slashes and the separators intact; query value escapes every reserved character on the assumption that what you pasted is one parameter; form follows the convention where + stands for a space, which is what an application/x-www-form-urlencoded body actually means. The two panes are linked, so you can read the decoded form of what you are about to send. Everything runs in your browser; the text you enter is not uploaded.

Building an API Query StringEscape a search term or a filter value before appending it to an endpoint, so a stray & or # in user input cannot end the parameter early.
Passing a URL Inside a URLEncode a destination address as a single query value for a redirect_uri or return_to parameter in an OAuth or SSO flow, where its own slashes and colons must be escaped.
Debugging a Raw RequestReconstruct the exact URL a client should have sent, in the mode that matches where the text was going, to find which layer escaped it wrongly.
Form BodiesProduce the encoding a submitted HTML form actually sends, spaces as + included, rather than the near-miss that percent-escaping everything would give.
Encoding a Sensitive ValueA token or a credential used as a URL parameter can be escaped here without being sent to a server that keeps it.

Set

Beveiligingstools 26

Neighbours

01 AES Bestand & Tekst Encryptor 02 Base64 Decoderen 03 Base64 Coderen 04 CSR Generator 05 DER naar PEM Converter 06 Hash Generator

Specification

Command: security.url_encode
Set: Security
Input: text
Output: —
Max. bestand: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Zoeken: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Type into either pane

Plain text on one side, percent-encoded on the other. Editing either pane updates the other, so encoding and decoding happen on the same screen.

Choose where the text is going

Three modes, because one rule does not fit all three jobs. Whole URL leaves the structure alone, so the scheme, the slashes and the separators survive. Query value escapes everything that would otherwise end a parameter. Form follows the convention where + means a space.

Copy the result

The output is ready to paste into a URL, a request, or a form body. Everything runs in your browser; the text you enter is not uploaded.

Frequently asked

What is URL encoding and why is it needed?

Percent-encoding rewrites characters that have a structural meaning in a URL — spaces, &, ?, #, / — as a % followed by two hex digits, so they can be carried as data instead of being read as syntax. Anything outside ASCII is encoded as its UTF-8 bytes, which is why a single accented letter becomes two escapes.

Which characters get encoded?

That depends on the mode. A query value escapes every reserved character, so a space becomes %20 and & becomes %26 and nothing you paste can end the parameter early. A whole URL leaves the scheme, the slashes and the separators alone and escapes only what would otherwise break parsing.

Is this the same as HTML encoding?

No. Percent-encoding uses % and two hex digits and applies to URLs. HTML encoding uses named or numeric entities such as & and < and applies to markup. Using one where the other is meant is a common source of doubled-up escaping.

Can I encode an entire URL?

Yes — that is what the whole-URL mode is for; it keeps the address working. Use the query-value mode instead when a URL is being carried inside another URL, as a redirect_uri or a return_to parameter: there the whole thing is one value, and its slashes and colons do need escaping.

Keys

Zoeken: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Gerelateerd · Beveiligingstools