How to URL encode/decode a query param (without %20 vs + traps)
Snippets to encode/decode query param values. Includes notes about encodeURI vs encodeURIComponent and application/x-www-form-urlencoded.
Use this article when...
This section is built for speed: one concrete task, multiple stacks, and the minimum context needed not to copy the wrong thing.
These pages work best when the incident is already concrete and you need a fast implementation path.
The snippet is only useful if the runtime, dependency model, and assumptions match your environment.
If the problem expands into architecture, security, or production tradeoffs, stop treating it like a copy-paste task.
What this article gives you
A short path from incident to implementation: context, language-specific snippets, and the warning signs that usually get skipped.
13
3
url, encoding, web, frontend, backend
There is no single “URL encoding”: it depends on context. For query param values, you usually want to encode almost everything (spaces, &, =, ?, /…).
Classic trap: in application/x-www-form-urlencoded, spaces are commonly represented as +. Mixing that with decodeURIComponent can cause + vs %20 bugs.
Dependency snapshot by language
Check this first to see which snippets use built-in/runtime APIs and which ones need external packages before you start copying code.
Python 3.
Built-in or runtime API
Review the notes for setup details.
Built-in or runtime API
Built-in or runtime API
Built-in or runtime API
Built-in or runtime API
Built-in or runtime API
Built-in or runtime API
Built-in or runtime API
urlencoding = "2".
Built-in or runtime API
Built-in or runtime API
How to use these code examples well
The snippet is only the fast path. The explanation and notes are what keep you from copying the wrong assumption into production.
Make sure the article really matches the issue you are debugging before copying code just because the title looks close.
That is where portability limits, dependency requirements, and runtime assumptions usually appear.
If the code runs but the bug remains, jump to the related tool and inspect the real payload, token, timestamp, or config.
Code examples by language
Snippets that compile/run, plus short explanations and real-world notes.
Bash
python -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=""))" "a b&c"
python -c "import urllib.parse,sys; print(urllib.parse.unquote(sys.argv[1]))" "a%20b%26c"
From shell, Python gives correct URL encoding for values (quote) and decoding (unquote).
- Dependency: Python 3.
- For form encoding use urllib.parse.urlencode and watch the + behavior.
C#
using System;
var value = "a b&c";
var encoded = Uri.EscapeDataString(value);
var decoded = Uri.UnescapeDataString(encoded);
Console.WriteLine(encoded);
Console.WriteLine(decoded);
EscapeDataString encodes a component (value) safely. UnescapeDataString reverses the process.
- Std.
- For full URLs, do not EscapeDataString the entire URL; encode components only.
Delphi
program UrlEncode;
{$APPTYPE CONSOLE}
uses
System.SysUtils,
System.NetEncoding;
var
Value: string;
Encoded: string;
Decoded: string;
begin
Value := "a b&c";
Encoded := TNetEncoding.URL.Encode(Value);
Decoded := TNetEncoding.URL.Decode(Encoded);
Writeln(Encoded);
Writeln(Decoded);
end.
TNetEncoding.URL lets you encode/decode URL components. Useful for query params and reserved characters.
- Std: System.NetEncoding.
- For application/x-www-form-urlencoded, watch spaces as +.
Go
package main
import (
"fmt"
"net/url"
)
func main() {
value := "a b&c"
encoded := url.QueryEscape(value)
decoded, _ := url.QueryUnescape(encoded)
fmt.Println(encoded)
fmt.Println(decoded)
}
QueryEscape is meant for query params and uses + for spaces (form encoding). QueryUnescape reverses it.
- Std.
- If you want %20 instead of +, use PathEscape for different contexts.
Java
import java.net.URLDecoder;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
public class Main {
public static void main(String[] args) {
String value = "a b&c";
String encoded = URLEncoder.encode(value, StandardCharsets.UTF_8);
String decoded = URLDecoder.decode(encoded, StandardCharsets.UTF_8);
System.out.println(encoded);
System.out.println(decoded);
}
}
URLEncoder/URLDecoder implement typical form encoding (space as +). Correct for x-www-form-urlencoded query params.
- Std.
- For full URLs, encode components only; not the whole URL.
JavaScript
const value = "a b&c";
const encoded = encodeURIComponent(value);
const decoded = decodeURIComponent(encoded);
console.log(encoded);
console.log(decoded);
encodeURIComponent is the correct option for query param values. decodeURIComponent reverses it.
- Std.
- Do not use encodeURI for values: it leaves reserved characters unescaped.
Kotlin
import java.net.URLDecoder
import java.net.URLEncoder
import java.nio.charset.StandardCharsets
fun main() {
val value = "a b&c"
val encoded = URLEncoder.encode(value, StandardCharsets.UTF_8)
val decoded = URLDecoder.decode(encoded, StandardCharsets.UTF_8)
println(encoded)
println(decoded)
}
In Kotlin/JVM use URLEncoder/URLDecoder just like in Java.
- Std.
- Be aware of + for spaces in form encoding.
PHP
<?php
$value = "a b&c";
$encoded = rawurlencode($value);
$decoded = rawurldecode($encoded);
echo $encoded . PHP_EOL;
echo $decoded . PHP_EOL;
rawurlencode encodes spaces as %20 (RFC 3986). Prefer it for values. rawurldecode reverses it.
- Std.
- urlencode uses + for spaces (form encoding).
Python
from urllib.parse import quote, unquote
value = "a b&c"
encoded = quote(value, safe="")
decoded = unquote(encoded)
print(encoded)
print(decoded)
quote with safe="" ensures reserved characters are escaped for a value. unquote decodes.
- Std.
- For form encoding, use urlencode and watch the + behavior.
Ruby
require "uri"
value = "a b&c"
encoded = URI.encode_www_form_component(value)
decoded = URI.decode_www_form_component(encoded)
puts encoded
puts decoded
encode_www_form_component is designed for query param values. decode_www_form_component reverses it.
- Std.
- It aligns with form encoding (space as +).
Rust
fn main() {
let value = "a b&c";
let encoded = urlencoding::encode(value);
let decoded = urlencoding::decode(&encoded).unwrap();
println!("{}", encoded);
println!("{}", decoded);
}
urlencoding encodes/decodes URL components easily. Useful for values in web/backends.
- Dependency: urlencoding = "2".
TypeScript
const value = "a b&c";
const encoded = encodeURIComponent(value);
const decoded = decodeURIComponent(encoded);
console.log(encoded);
console.log(decoded);
In TS/JS, encodeURIComponent is the standard for query param values.
- Std.
VB.NET
Imports System
Module Program
Sub Main()
Dim value = "a b&c"
Dim encoded = Uri.EscapeDataString(value)
Dim decoded = Uri.UnescapeDataString(encoded)
Console.WriteLine(encoded)
Console.WriteLine(decoded)
End Sub
End Module
Uri.EscapeDataString is a safe way to encode a URL component (value).
- Std.
Related tools
Use the tool when you need to generate or validate output fast.
Trust and privacy
Copy/paste-friendly by design. Still, treat real production secrets carefully.
- Prefer synthetic examples when sharing screens or recording.
- Do not paste real API keys, tokens, or personal data unless you fully trust your environment.
- If you need ordering, do not use UUID v4 as a sortable id: add createdAt or use sortable ids.