URL Encoding Guide: Safe Query Strings

What URL encoding solves

URL encoding (percent-encoding) makes query strings safe — spaces, unicode, ampersands, and equals signs in values become escape sequences so servers parse parameters correctly instead of truncating or splitting at the wrong character.

Broken links often come from hand-built URLs where a product name with & or # was pasted raw into a query value. Encoding transforms user-facing text into wire-safe bytes without changing meaning at the server.

BrowserTools.tech URL Encoder runs locally for quick encode/decode checks; Query String Builder and UTM Builder assemble full links so you spend less time hunting missing %20 sequences.

Encode values, not structure

Encode parameter values and individual path segments when they contain reserved characters. Do not encode the entire URL including scheme (https://) and host — that produces illegal links no browser can fetch.

Separators like ? between path and query, & between pairs, and = between keys and values stay unencoded as structure. Only the keys and values on the right side of those delimiters get escaped when needed.

• Encode: spaces, unicode letters, &, =, +, # inside values.
• Do not encode: https://, domain dots, path slashes that define routes.
• Double-encoding happens when you encode an already encoded string — decode once, then encode once.

Common failure patterns

Plus signs (+) in query strings historically meant space in application/x-www-form-urlencoded contexts; some servers treat + and %20 differently. When debugging, try both interpretations if a legacy API behaves oddly.

Unicode must be UTF-8 bytes before percent-encoding. Mojibake in links usually means the wrong charset at encode time, not a bad decoder.

Builders vs manual encoding

Manual encoding does not scale for campaign work. UTM Builder adds utm_source, utm_medium, and utm_campaign with proper escaping. Query String Builder handles arbitrary keys for preview modes, affiliate IDs, and search facets.

Workflow: draft in a builder, copy the full URL, paste into URL Encoder only when you need to inspect a single suspicious value — not to rebuild the entire link by hand.

• UTM Builder — marketing links with consistent naming.
• Query String Builder — multi-parameter app and API URLs.
• URL Encoder — debug one value or decode a broken link from logs.

Decoding for debugging

Logs often show encoded URLs. Decode to read human-meaningful parameters when correlating errors — but never trust decoded content from untrusted users without server-side validation anyway.

Redact tokens and session IDs before pasting encoded URLs into tickets, even when using local tools.

Security reminder

Encoding is not encryption or authentication. An encoded password in a query string is still visible in browser history and referrer headers on some navigations. Put secrets in headers or POST bodies, not URLs.

Open redirects love sloppy query parsing. Validate destinations server-side; encoding alone does not make a link safe to follow.