You build a link. It works in the browser when you click it. It fails when you paste it into a JSON body, a CSV, or a redirect rule. A space becomes a problem. An ampersand eats the rest of the query. A plus sign turns into a space and a token dies.
URL encoding is the set of rules that turn “unsafe” characters into %xx so the URL remains a URL. Nicxro’s URL encoder/decoder is for seeing those rules instead of guessing them in a spreadsheet.
This is how to encode the right part of a URL, decode without making it worse, and stop the bugs that only show up in production query strings.
A URL is not one string with the same rules everywhere
A typical URL has a scheme, host, path, query, and fragment.
https://nicxro.online/tools/json?source=docs&q=hello world#top
The space in hello world must be encoded in the query. The #top is a fragment and is not sent to the server. If you encode the whole URL including https://, you can break it by encoding colons and slashes you needed.
The practical rule: encode parameters, not the entire URL, unless you are embedding the entire URL inside another URL. Those are different jobs.
When to encode a query value
If a value can contain &, =, +, space, #, %, non-ASCII, or reserved characters, encode it before you put it in the query.
Search: q=json formatter should become q=json%20formatter or q=json+formatter. Both appear in the wild. application/x-www-form-urlencoded often uses + for space. Percent-encoding uses %20. Mixing them is how you get plus signs in search boxes.
Tokens: token=abc+def/ghi= must be encoded or + may become space and / may confuse some parsers. Base64 in query strings should be URL-safe Base64 (- and _) or fully percent-encoded. This is the cousin of the Base64 article. Do not invent a third dialect.
Emails and names: ada@example.com in a query should usually be ada%40example.com. Some servers accept @. Do not rely on that.
When to encode a path segment
Paths can include unicode and spaces if encoded. /tools/my file is not a reliable path. /tools/my%20file is.
Do not encode slashes that are real path separators. Encode slashes that are part of a single parameter you stuffed into a path, which you should rarely do. Query strings exist for a reason.
Double encoding, the silent classic
You encode once: space becomes %20.
A middleware encodes again: % becomes %25, so you get %2520.
The server decodes once: it gets %20 as a literal percent sequence, not a space. Search fails. Redirects fail. Logs look cursed.
If you see %25 in a URL, someone encoded an already encoded string. Decode once in Nicxro and look. If you still see %20, it was double encoded. Fix the layer that encoded twice. Do not “just decode until it looks right” in production without knowing how many times the client will encode.
Decoding without turning the URL into soup
Paste a query string into the decoder. You should get readable values. If you decode a full URL, check that https:// did not become something stupid. Some “decode” buttons treat + as space. That is correct for form bodies and wrong if + was a significant character in a token that was never form-encoded.
Know which decoder you are using. RFC 3986 vs form encoding is a real fork.
If decode produces , the bytes were not UTF-8 or the percent sequences are incomplete (%2 at end of string). Truncated URLs in emails and SMS are common. Get the full link.
Embedding a URL inside a URL
Redirects: https://site.com/r?next=https://nicxro.online/tools?x=1
The inner URL contains ? and &. You must encode the entire inner URL as one parameter:
next=https%3A%2F%2Fnicxro.online%2Ftools%3Fx%3D1
If you do not, x=1 becomes a second parameter of the outer URL. The redirect target is wrong. Open redirect bugs also hide here. Servers must allowlist destinations, not only encode.
Use Nicxro to encode the inner URL, then paste it as the value. Do not encode the outer URL.
JSON, HTML, and CSV each add a layer
In JSON, a URL is a string. You must escape backslashes and quotes for JSON, which is separate from URL encoding. \" is JSON. %22 is a quote inside a URL. Mixing them up is common when building strings by hand.
In HTML, & in a URL inside an href should be & in HTML source. The browser still requests &. If you URL-encode & as %26 in an href when you meant a query separator, you break the query. HTML entity encoding and URL encoding are different tools.
In CSV, commas in URLs need CSV quoting, not extra percent encoding, unless you also need URL safety. Encode for the transport you are in.
International characters
Users search in their language. Browsers show unicode in the address bar and send percent-encoded UTF-8 on the wire. Your server should decode UTF-8. If it decodes as Latin-1, you get mojibake in logs and empty search results.
If you hash or log URLs, decide whether you log the encoded or decoded form. Comparing encoded strings that differ by uppercase hex (%2f vs %2F) can be a false mismatch. Normalize if you compare.
A debug loop that works
- Split the URL at
?. Leave the base alone. - Split query on
&. Split each pair on the first=. - Decode each value in Nicxro.
- Look for truncated values, leftover
%, and+that should not be spaces. - Re-encode values with a single, known scheme.
- Rebuild the query.
- Test the request in the same client the user uses. Slack, email, and QR codes all wrap links differently.
If a campaign link fails, this loop is faster than rewriting the ads platform.
Security notes you should not skip
Open redirects: encoded URLs as next= parameters.
CRLF: encoded %0d%0a in headers if you put URLs in headers carelessly.
Double decoding that bypasses a filter: a firewall sees ..%252f and the app decodes twice to ../. Encode and decode counts must be explicit.
Do not URL-encode passwords thinking they are hidden. They are still in the query, still in logs, still in history. Use headers or POST bodies.
Mailto, SMS, and other non-https schemes
mailto:ada@example.com?subject=Hello world needs the subject encoded. Spaces and ampersands in subjects are a frequent broken-share-button bug. sms: and tel: links have their own messy conventions. Encode values. Test on iOS and Android because they do not always honor the same extras.
QR codes that contain URLs should use an already-correct encoded URL. If you encode twice before generating the QR, scanners open a broken link. Generate, scan, confirm the address bar.
Analytics parameters that look harmless
UTM tags belong in values, encoded. If a value contains &utm_content=hero+banner, that plus sign may become a space depending on the decoder. Decide on %20 vs + and stay consistent with the ads platform. When a report shows hero banner instead of hero+banner, you are looking at a form-encoding mismatch, not a failed campaign.
Practical habit
When a query string misbehaves, decode it. When you build a query string, encode each value once. When you nest URLs, encode the inner one as a single value.
Nicxro’s URL encoder is the scratchpad for that. Paste the messy link, see the characters, fix the one layer that is wrong. The goal is a link that survives email, JSON, analytics, and a phone browser without eating its own parameters.