Encoding and security guides

URL encoding: spaces, plus signs and double encoding

Encode a query value once, preserve literal plus signs, and distinguish a URL component from a complete URL.

Nav Tools ·

Encode a component

A query value containing an ampersand needs escaping so it is not mistaken for another parameter. Encode values, not the entire URL structure.

Use URLSearchParams with raw values to build queries. Passing already encoded values into it escapes the percent sign again.

new URLSearchParams({q:"a&b"}).toString()
→ q=a%26b

Plus has a context

Form-style query parsing treats + as a space. A literal plus sign must be represented as %2B in that context.

Percent decoding alone does not necessarily apply form rules. Nav Tools offers separate component decoding and query inspection; check which one matches your protocol.

q=a+b   → "a b" in form query parsing
q=a%2Bb → "a+b"

Recognize double encoding

The percent sign is encoded as %25, so %252F decodes once to %2F and twice to /. Those values can mean different things in a route.

Do not repeatedly decode until the output looks readable. Define the number of encoding layers at the boundary to avoid changing path separators unexpectedly.

Verify a round trip

Build a query with spaces, a literal plus, Unicode and an ampersand. Parse it once and compare the resulting values with the originals.

Keep repeated keys if the API permits them. Converting a query to an ordinary object can discard duplicates even when the URL is correctly encoded.

References

← Encoding and security guides