Common URL encoding mistakes (and how to fix them)

Most URL encoding bugs come from applying the wrong function, encoding too much or too little, or encoding twice. Below are the mistakes that show up most often - and how to fix them - then encode or decode locally to verify.

Encoding the entire URL

Running component-style encoding on a full URL turns https:// and & into percent sequences and breaks the link. Encode individual path segments and query values, then assemble the URL with normal separators.

Using encodeURI when you need encodeURIComponent

encodeURI leaves &, =, and / alone. If those characters appear inside a value, the server may split parameters incorrectly. Prefer encodeURIComponent (or this tool) for values.

Double-encoding

Encoding an already-encoded string turns %20 into %2520. Decode once and inspect before encoding again. If a value looks like it already contains % sequences, check whether it still needs encoding.

Mixing + and %20 for spaces

Form-urlencoded bodies often use + for spaces; many modern query strings use %20. Mixing conventions without decoding correctly produces odd results. Prefer %20 unless the target format requires +.

Leaving reserved characters raw in values

An unencoded & or = inside a value starts a new parameter or key/value split. Always encode dynamic input before inserting it into a query.

How to check quickly

1. Open the URL encoder.
2. Decode the suspicious string once and read the plaintext.
3. Re-encode only the component you need, then rebuild the URL with clear separators.

Encode or decode URL components free in your browser - catch mistakes without uploading.
Open the free URL tool →

Related: What is URL encoding? · How to encode and decode URLs