URL encoder and decoder

The two modes, and why picking wrong breaks the link

This is what brings most people here, and it takes one line to explain: the difference is whether the characters that give the address its structure get encoded — the colon, the slashes, the question mark, the hash, the ampersand and the equals sign.

Starting from the same phrase, https://example.com/my page?q=café:

• As a single value it becomes https%3A%2F%2Fexample.com%2Fmy%20page%3Fq%3Dcaf%C3%A9. It is no longer an address: it is a piece of text. And that is exactly what you need in order to put it inside another address's parameter, which is where all those url=https%3A%2F%2F… strings come from.
• As a whole address it becomes https://example.com/my%20page?q=caf%C3%A9. It is still an address, with its slashes and question mark untouched, but with the space and the accent fixed. That is what you need to repair an address that already is one.

Getting it wrong fails in both directions. Encode a whole address as if it were a value and it becomes text that leads nowhere. Encode a value as if it were an address and the slashes and ampersands inside it are left alone, so the address splits at points where it was never meant to and the destination receives half a parameter.

Why %20 signs appear

Because an address may only carry a handful of characters, and the space is not one of them. When one that is not allowed has to go in, it is replaced by a percent sign followed by its number in hexadecimal. The space is character 32, which is 20 in hexadecimal; hence %20, and hence the name of the system: percent encoding.

With accents there is an extra step. The letter ñ has no number below 256, so it is first turned into UTF-8 bytes — ñ is two of them, C3 and B1 — and then each byte is written with its own percent: %C3%B1. The euro sign is three bytes and an emoji is four, which is why an emoji takes twelve characters once encoded. That is handled properly here; it is where quite a few tools fall over, stopping at the first 256 characters and returning nonsense the moment an accent shows up.

Seeing %20 in a URL is not an error: it is the correct way to write it, and the browser undoes it when displaying the page. You only see it when someone copies it into a place where nothing translates it back.

The + sign and the misunderstanding it drags along

In the query string — everything after the question mark — a plus sign means space. It comes from the format web forms use to send their data, and it is still alive across half the internet. Everywhere else in the address, a plus is a plus.

The trouble is that the function almost every tool uses to decode knows nothing about that: it returns the plus as it is. That is why you paste John+Smith and get John+Smith instead of John Smith. Here it is a checkbox, on by default because it is almost always what you want. And it works the other way round just as well: a plus that really is a plus is encoded as %2B, so C++ comes back intact even with the box ticked.

Encoding twice: where %2520 comes from

The percent sign is special too, so it has to be encoded itself: its code is %25. If you take a %20 — already an encoded space — and encode it again, the percent turns into %25 and you get %2520.

When it is opened, the browser undoes a single layer: where it should see a space it sees the literal text "%20", looks for a file that does not exist and returns an error. It happens when a link crosses two systems and each encodes it without checking whether it was encoded already. The tool detects it and says so, naming the exact sequence and what it was before. The fix is to decode until no sequences are left, or to encode the original only once.

Campaign links, and the detail that splits reports

The five UTM fields are the standard way of telling analytics where each visit came from, and every tool understands them with no configuration. Three matter nearly always — source, medium and campaign — and two are optional.

The mistake that ruins most reports is not spelling them wrongly: it is spelling them two different ways. Analytics is case-sensitive, so "Facebook" and "facebook" are different sources and the same campaign comes out as two rows you have to add up by hand. Same with spaces, which show up in the report as %20 or as plus signs. Both are flagged here before they happen, and there is a checkbox to normalise everything automatically.

One more detail: if the destination URL already carried campaign fields, they are replaced in place rather than added again. Pasting the same link twice is the usual way of ending up with two campaigns for one click.

The final link comes with a downloadable QR code, for a poster or a flyer. If you need something more elaborate — with a logo, colours, or a different kind of content — the site has a full QR code generator.

Domain names in disguise

A domain can be written in any alphabet, but underneath it travels converted into a form that starts with xn--. That is what lets españa.com exist, and also what lets someone register a domain that looks like a well-known brand using a letter from another alphabet that appears identical.

When the parser sees one of those, it translates it back and shows you what it actually says. It is a piece of information almost no tool gives, and it is welcome exactly when you are deciding whether to click a link.

Every equivalence in these tables comes from the same engine the tool above uses, so they cannot contradict it. A dash in a column means that character is left alone in that mode.