URL Encoder/Decoder & Inspector – @Rank Software Development

A URL, or a value to put in one

Encoded

the difference between these two is why links break

As a whole URL encodeURI()

Leaves & = / ? # + : $ , ; alone, because they are what gives a URL its structure.

As one value inside a URL encodeURIComponent()

Escapes them, because inside a value an & would end your parameter and start another.

Decoded

In a path, or anywhere else decodeURIComponent()

A + stays a plus sign.

In a query string form rules

A + becomes a space. Same bytes, different answer — decided entirely by where they sit.

The parts

Read in this browser — nothing is uploaded and nothing is stored, which matters here because a URL often carries a session token or a signed redirect. Punycode hosts are decoded with RFC 3492 written out, because new URL() will not do it — and xn--80ak6aa92e.com decodes to a name whose five letters are Cyrillic а, р, р, ӏ and е. Rendered on a screen it is indistinguishable from the English word, which is the entire attack; the tool reports the mixed script rather than relying on you to spot it.

The URL Encoder/Decoder needs JavaScript: the encoding, decoding and parsing all happen in this browser. With JavaScript switched off there is nothing to do the work.