English
terminalToolAcre
format_image_left 100% Client-Side Zero Telemetry
data_object RFC 3986 Transcoding Engine

URL & URI Component Transcoder

Encode and decode query parameters, path segments, and full URLs with exact RFC 3986 compliance. Seamlessly transcode UTF-8 multi-byte glyphs, diagnose recursive double-encoding faults, and decompose nested payloads.

Example Presets:
Input Raw Payload
0 chars • 0 bytes (UTF-8) • 0 encodings
memory Local Memory
Transcoded Output
Transcoded output will appear here automatically. Type in the input console or pick a preset above.
Component Syntax % Tokens Query Delims
±0% change
tune

Parser Directives & RFC Switches

Runtime switches evaluate in real-time
account_tree WHATWG URL Breakdown

Structured URL Decomposition Inspector

check_circle Valid Absolute URI
Protocol / Scheme https:
Hostname api.toolacre.com
Port 443 (default)
Pathname /v1/checkout/session
Hash Fragment #step-payment
Parsed Query String Parameters 4 keys
Key Raw Encoded Value Decoded Value Actions
ADVERTISEMENT
728x90 Leaderboard Unit • Client Sandboxed Non-Tracking Ads
Engineers' Specification

RFC 3986, WHATWG, and Encoding Mechanics

Detailed breakdown of character sets, percent-encoding matrix differences, and the root causes of corrupted HTTP payloads.

grid_4x4

RFC 3986 Character Matrix

RFC 3986 divides ASCII into unreserved characters (letters, digits, - . _ ~) which should never be encoded, and reserved delimiters (: / ? # [ ] @ ! $ & ' ( ) * + , ; =).

encodeURI(): Keeps ;,/?:@&=+$-_.!~*'()# intact.
encodeURIComponent(): Encodes everything except -_.!~*'().
Spec: IETF RFC 3986 § 2.2
sync_alt

The Mystery of `%20` vs `+`

A notorious source of bugs. RFC 3986 mandates spaces be encoded strictly as %20. However, HTML form submissions historically used the W3C application/x-www-form-urlencoded spec, where spaces serialize to +.

In modern APIs (JSON REST, gRPC-Web), using + in paths is taken literally as a plus glyph, corrupting tokens or base64 keys without explicit form parsers.
Spec: WHATWG URL Standard § 5
layers

Preventing Double-Encoding

When an application blindly runs encodeURIComponent() on a query parameter already encoded by an upstream proxy, %20 transforms into %2520.

OAuth state payloads and JWT redirect paths are especially vulnerable. Always inspect inputs with /%25[0-9a-fA-F]{2}/ before serializing downstream.
Remediation: Idempotent Normalization

Percent-Encoding Character Behavior Comparison

Character Name / Symbol Percent Encoded encodeURI() encodeURIComponent() Form Data
  (space) ASCII 32 %20 %20 %20 + (or %20)
/ Forward slash %2F / (Preserved) %2F %2F
? Question mark %3F ? (Preserved) %3F %3F
& Ampersand %26 & (Preserved) %26 %26
# Hash / Fragment %23 # (Preserved) %23 %23
% Percent Literal %25 %25 %25 %25