URL Decoder & Encoder

What is URL encoding?

URL encoding (percent-encoding, defined in RFC 3986) replaces any character outside a small "safe" set with %XX, where XX is its byte value in hex. It's how arbitrary text, such as spaces, non-ASCII characters, and reserved punctuation, can be embedded safely inside a URL.

Component vs. full URL encoding

Use component mode (encodeURIComponent) for a single value you're about to insert into a URL, such as a query parameter or a path segment, since it escapes characters like &, =, and ? that would otherwise break the URL's structure. Use full-URL mode (encodeURI) only when you already have a complete, valid URL and just want to escape unsafe characters (spaces, non-ASCII) without touching its structure.

'+' vs. '%20' for a space

application/x-www-form-urlencoded (the format of classic HTML form submissions and most query strings) historically uses + for a space. Standard percent-encoding (encodeURIComponent/encodeURI) always uses %20. Mixing the two conventions up is a common source of "my parameter has a literal plus sign in it" bugs.

Common redirect_uri encoding gotchas in OAuth

Authorization servers compare an incoming redirect_uri byte-for-byte against the value registered for the client. See a step-by-step guide to OAuth 2.0. Double-encoding it (encoding a value that was already encoded) is one of the most common causes of an "invalid redirect_uri" error. A literal %25 in the decoded value is the tell: it's an encoded "%", meaning the string was percent-encoded twice. Use the query-string parser above to check exactly what an authorization server will actually receive.

URL-encoding in .NET

using Microsoft.AspNetCore.WebUtilities;

// Encode a single value (like encodeURIComponent)
string encoded = Uri.EscapeDataString("redirect_uri value with spaces");

// Build a full query string safely
string url = QueryHelpers.AddQueryString(
    "https://demo.duendesoftware.com/connect/authorize",
    new Dictionary<string, string?>
    {
        ["client_id"] = "spa",
        ["redirect_uri"] = "https://app.example.com/callback",
        ["response_type"] = "code",
    });