PDFFlare
7 min read

How to URL Encode and Decode Online (Special Characters Explained)

You paste a link with an emoji or a space into an email, and the recipient gets a broken URL full of %20 and %F0%9F%98%80. You build a search URL with a user query and it breaks when someone types an &. You receive a tracking URL and want to see what the parameters actually say. All three situations involve the same fundamental concept: URL encoding.

In this guide you will learn what URL encoding is, which characters need encoding, and how to encode or decode URLs online using PDFFlare's URL Encode/Decode tool.

What URL Encoding Actually Does

URLs can only contain a limited set of ASCII characters. Spaces, emoji, accented letters, and reserved characters (&,=, ?, /, #) cannot appear in a URL as-is without confusing the browser.

URL encoding (also called percent-encoding) converts every unsafe byte into %XX, where XX is the hex code for the byte. A space becomes %20. An& becomes %26. An emoji becomes four bytes of UTF-8, each encoded as %XX.

How to URL Encode or Decode (Step by Step)

  1. Open the tool: PDFFlare's URL Encode/Decode tool.
  2. Pick a direction:Encode (plain text → percent-encoded) or Decode (percent-encoded → plain text).
  3. Paste your input: A full URL, a query parameter value, or any string.
  4. Click Encode / Decode: The result appears instantly below the input.
  5. Copy: One click to clipboard.

Which Characters Need Encoding?

Always Safe (No Encoding Needed)

Letters (A-Z, a-z), digits (0-9), and the four “unreserved” marks: -, _, ., ~.

Reserved — Encode When Used as Data

These characters are part of URL syntax and need encoding when they appear in a query parameter value or path segment:

  • : → %3A
  • / → %2F
  • ? → %3F
  • # → %23
  • [ → %5B, ] → %5D
  • @ → %40
  • ! → %21, $ → %24
  • & → %26, = → %3D
  • + → %2B

Always Encode

  • Space: %20 (or + in query strings)
  • Quotes and brackets: ", <, >
  • Percent sign itself: % → %25
  • Any non-ASCII character: encoded as UTF-8 then percent-encoded

When You Need URL Encoding (Common Scenarios)

Building Search and Filter URLs

User-generated input — search queries, filter values, sort fields — almost always contains characters that need encoding. A search for “coffee & tea” concatenated naively into ?q=coffee & tea drops everything after the ampersand. Encode every value before splicing it into a URL.

OAuth and Authentication Callbacks

OAuth redirect URIs, state parameters, and code challenges all travel through query strings. The state parameter especially — often a JSON blob or random token — must be URL-encoded to survive the round trip. Failing to encode breaks the callback and locks users out.

Share-to-Social URLs

Twitter share intents, Slack “send” URLs, mailto links all take a pre-filled message in a query parameter. The message contains spaces, punctuation, possibly emoji — all need encoding. PDFFlare's tool gives you the encoded share URL ready to drop into an <a href>.

Tracking and Analytics URLs

UTM parameters with campaign names like “spring sale 2026” need spaces encoded. Reading an inbound URL with strange %XX sequences? Decode it first to see what the marketer actually sent — then debug from clean values.

Deep Links Into Mobile Apps

iOS Universal Links and Android App Links pass data through query parameters. Anything containing punctuation, emoji, or non-ASCII text needs encoding. Test with the decode tool to verify the link unpacks correctly on the device.

API Path Parameters with User IDs

REST endpoints like /users/{id}/posts with user-supplied IDs need encoding when the ID contains slashes, colons, or non-ASCII characters (common with email-as-ID schemes). Encode at the boundary, decode in the route handler.

URL Encoding by Position: Path vs Query vs Fragment

Different parts of a URL have different escaping rules. Knowing which applies prevents subtle bugs:

  • Path segments: Anything between slashes. Encode the slash itself when it appears inside a value, plus all reserved characters. Spaces become %20, never +.
  • Query string keys and values: Encode &, =, +, and ?. In form-style encoding (default for HTML forms), spaces become +; in modern URI templates, %20.
  • Fragment (after #): Slightly more permissive — ? and /don't need encoding. But still encode anything that would terminate the fragment.
  • Userinfo (rarely used today): user:pass@ in URLs encodes @ within the username/password, because @ separates userinfo from host.

Common URL Encoding Mistakes

Not Encoding User Input

Building a URL from user input without encoding is a classic bug:

/search?q=hello & welcome

The & terminates the query parameter, so only hello reaches the server. The correct encoding:

/search?q=hello%20%26%20welcome

Double Encoding

Passing an already-encoded string through an encoder again turns %20 into %2520. The server decodes one layer and gets %20 instead of a space, leading to broken URLs. Decode first to check, then encode once.

Space as + vs %20

Both are valid in query strings (after the ?), but only %20 is valid in the path portion. When in doubt, use %20 — it works everywhere. The + substitution is a quirk of HTML form submissions.

Encoding the Whole URL Instead of Just a Value

Never encode a full URL, or you break its syntax. Encode only the value of each query parameter:

Wrong: https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dhello

Right: https://example.com/search?q=hello

Programming Language Equivalents

  • JavaScript: encodeURIComponent(value) for values, encodeURI(url) for full URLs.
  • Python: urllib.parse.quote(value) for values, urllib.parse.quote_plus(value) for form encoding.
  • Go: url.QueryEscape(value).
  • PHP: urlencode($value) or rawurlencode($value).
  • Java: URLEncoder.encode(value, "UTF-8").

Related Developer Tools

Working with URLs and data encoding often go together:

Workflow Notes Beyond the Basics

URL encoding sits at the boundary between human-readable text and machine-parseable URIs, and getting it right is more nuanced than the basic mechanics suggest. The deeper point underneath all of this is that workflow tools earn their place not in the simple cases but in the cases where defaults fail. The simple cases are easy: drag, drop, click convert, done. The interesting cases are the ones where the defaults produce output that does not quite work, and the difference between a tool that survives a year of daily use and one that gets replaced is whether it gives you the knobs needed to handle those edge cases without leaving the tool. PDFFlare is built around that observation: every tool exposes the options that matter, the defaults work for ninety percent of cases, and the remaining ten percent have a clear path forward without requiring a different application or a complicated workflow. Try the tool on a real piece of work, identify where the defaults could be better for your specific use case, and adjust the relevant option. After a few iterations, you have a setting profile that matches your work better than any out-of-the-box default could, and the tool stops being a generic utility and starts being your tool, customized for what you actually do. That gradient — from generic utility to personalized tool — is the real value, and the time spent on the calibration pays back in every subsequent use of the tool over years of work.

One pattern worth internalizing about file workflows in general is that the cost of getting a setting wrong scales with how often you repeat the workflow. A one-off conversion where you accept the defaults loses you nothing if those defaults are slightly suboptimal. The same defaults applied to a recurring monthly process across hundreds of files accumulate into real time and quality losses over a year. The right discipline is to invest a few minutes calibrating a workflow the first time you set it up, document the settings somewhere you can find them later, and then run the calibrated workflow without further thought for the next six to twelve months. Re-evaluate when something changes, not on every individual run. This rhythm matches how most professionals work in practice — they have a few well-understood workflows that they execute on autopilot, and a much smaller number of new workflows that get the deliberate setup attention. The trick is to make sure your recurring workflows are the calibrated ones, not the default-accepting ones. PDFFlare's tools support this pattern by exposing the calibration knobs prominently and making them easy to discover, so the time you invest in setting up a workflow once compounds across every later execution. The end result is fewer surprises, more predictable output, and a noticeable reduction in the small frictions that interrupt focused work.

Wrapping Up

URL encoding is one of those invisible pieces of plumbing that silently breaks software when ignored. Spaces, emoji, ampersands, and reserved characters all need to be percent-encoded before they hit a URL. PDFFlare's URL Encode/Decode tool handles both directions in your browser, no signup, no logging.

Related Tools

One more habit worth mentioning: keep a small log of the settings you actually use for recurring workflows, ideally in plain text in a folder you can search later. The first time you find yourself trying to remember whether you used eighty percent quality or eighty-five, or whether the last conversion targeted Letter or A4, the value of the log becomes obvious. Most professionals lose more time re-deriving settings they have already chosen than they do on the underlying conversion work, and a five-line note in a project README solves the problem permanently. The discipline of writing down your decisions and the reasoning behind them turns ad-hoc workflow tweaking into a maintainable practice that survives team turnover, sabbatical months, and your own forgetfulness across enough time that the original context fades. This is the kind of small investment that distinguishes someone who has been doing this work for ten years from someone who has been doing it for one.

Back to all posts