URL Encoder and Decoder - SimeonOnSecurity
NOTE: This tool runs entirely in your browser with client-side JavaScript. Anything you paste stays on your machine and is never transmitted, logged, or stored.
Which Mode to Use
| Encode Component | Escapes every reserved character, including / ? : & = + #. Use this for a single value such as a query parameter. |
|---|---|
| Encode Full URL | Preserves structure characters so the address still parses. Use this when the whole URL is the input. |
| Decode | Reverses percent-encoding. A malformed sequence is reported instead of guessed at. |
Why Percent-Encoding Matters
- Parameter confusion. An unencoded
&or=inside a value splits it into extra parameters. - Path traversal. An unencoded
../changes which file the server resolves. - Injection. Encoded input that is decoded too early by one layer and passed to another is how request smuggling and header injection start.
Sponsored by The Cyber Sentinels Club
