# URL Encoder / Decoder — Character Encodings, Encoding Guides, Language Guides

For the full tool, see: [https://capytoolkit.com/tools/security/url-encoder/](https://capytoolkit.com/tools/security/url-encoder/)

## URL Encoder / Decoder Reference
[Space in a URL (%20)](https://capytoolkit.com/tools/security/url-encoder/reference/#url-encode-space): A space becomes %20 in a URL under RFC 3986, or a plus sign in form encoding. Learn why a raw space breaks a URL, where each form belongs, and how to decode it.
[Ampersand in a URL (%26)](https://capytoolkit.com/tools/security/url-encoder/reference/#url-encode-ampersand): An unencoded ampersand splits one query value into two parameters. Learn why & is %26 under RFC 3986, how it differs from &, and how to keep a value whole.
[Forward Slash in a URL (%2F)](https://capytoolkit.com/tools/security/url-encoder/reference/#url-encode-forward-slash): A forward slash separates path segments, so a slash inside a value must become %2F. Learn the encoding, the server traps around %2F, and how to check it.
[Plus Sign in a URL (%2B)](https://capytoolkit.com/tools/security/url-encoder/reference/#url-encode-plus-sign): A plus sign means a space in form encoding, so a literal + must become %2B. Learn why phone numbers and base64 tokens corrupt in URLs and how to protect them.
[Percent Sign in a URL (%25)](https://capytoolkit.com/tools/security/url-encoder/reference/#url-encode-percent-sign): The percent sign introduces every escape, so a literal % must become %25. Learn why decoding throws errors, how %2520 signals double encoding, and how to fix it.
[Hash Sign in a URL (%23)](https://capytoolkit.com/tools/security/url-encoder/reference/#url-encode-hash): A hash begins the URL fragment, so a literal # in a value must become %23 or the URL truncates. Learn the fragment boundary and how to protect a color code or hashtag.
[Question Mark in a URL (%3F)](https://capytoolkit.com/tools/security/url-encoder/reference/#url-encode-question-mark): The first question mark starts the query string, so a literal ? in a path must become %3F. Learn the path-query boundary, when a second ? is fine, and how to check it.
[At Sign in a URL (%40)](https://capytoolkit.com/tools/security/url-encoder/reference/#url-encode-at-sign): The at sign separates userinfo from the host, so an email in a URL is safest as %40. Learn the authority rule, the phishing trick behind @, and how to encode it.

## Encoding Guides
[encodeURIComponent vs encodeURI](https://capytoolkit.com/tools/security/url-encoder/encodeuricomponent-vs-encodeuri/): encodeURIComponent escapes delimiters, encodeURI preserves them. Learn the exact character sets, when each is correct, and the bugs that come from picking the wrong one.
[Double URL Encoding](https://capytoolkit.com/tools/security/url-encoder/double-url-encoding/): Double URL encoding happens when a string is encoded twice, turning %20 into %2520. Learn how it starts, how to detect the %25 fingerprint, and how to decode it safely.
[URL Encoding vs HTML Encoding](https://capytoolkit.com/tools/security/url-encoder/url-encoding-vs-html-encoding/): URL encoding protects a URL; HTML encoding protects markup. Learn why they solve different problems, why %26amp; is a common mistake, and the order to apply them.
[Unicode and UTF-8 URL Encoding](https://capytoolkit.com/tools/security/url-encoder/unicode-url-encoding/): A non-ASCII character is UTF-8 encoded before it is percent-escaped, so e becomes %C3%A9 and an emoji becomes four escapes. Learn the byte math and how to verify it.
[URL Encoding Special Characters](https://capytoolkit.com/tools/security/url-encoder/url-encoding-special-characters/): RFC 3986 splits URL characters into unreserved, reserved, and everything else. See the complete list of special characters, which ones need escaping, and why.
[Encoding a Query String](https://capytoolkit.com/tools/security/url-encoder/url-encode-query-string/): A query string is built by encoding each key and value separately, then joining them, not by encoding the whole string at once. Learn the correct construction order.

## URL Encoder / Decoder: Code Examples
[URL Encoding in Python](https://capytoolkit.com/tools/security/url-encoder/code-examples/#python-url-encoding): Python offers four url-encoding functions in urllib.parse, each with different defaults for the safe set and the space character. Learn which one to use and why.
[URL Encoding in PHP](https://capytoolkit.com/tools/security/url-encoder/code-examples/#php-url-encoding): PHP has two url-encoding functions that disagree on the space and the tilde. Learn when rawurlencode (RFC 3986) is correct and when urlencode (form data) is correct.
[URL Encoding in Java](https://capytoolkit.com/tools/security/url-encoder/code-examples/#java-url-encoding): java.net.URLEncoder targets application/x-www-form-urlencoded, not RFC 3986 URLs. Learn its exact character set, the Charset overload, and when to use URI instead.
[URL Encoding in Node.js](https://capytoolkit.com/tools/security/url-encoder/code-examples/#nodejs-url-encoding): Node.js offers three ways to encode a URL, and each treats the space character differently. Learn when URLSearchParams, the URL class, or encodeURIComponent applies.
[URL Encoding in Go](https://capytoolkit.com/tools/security/url-encoder/code-examples/#go-url-encoding): Go net/url splits encoding into QueryEscape and PathEscape, which disagree on the space and plus sign. Learn which to use for paths, queries, and url.Values.
[URL Encoding with curl](https://capytoolkit.com/tools/security/url-encoder/code-examples/#curl-url-encoding): curl does not encode a raw -d value automatically. Learn the four syntax forms of --data-urlencode, how -G turns it into a GET query string, and common mistakes.