Ir para o conteúdo
DevTools / Codificador de URL e HTML

Codificador de URL e HTML

Two escaping systems cause a disproportionate share of web bugs. URL encoding decides whether an ampersand in a query parameter is data or a separator. HTML entity encoding decides whether a less-than sign is text or the start of a tag. This tool handles both, with a live preview of the decoded markup so you can see what a browser will actually render, and a validator that flags the malformed percent sequences that most encoders happily pass through.

Roda inteiramente no navegador — nada é enviado.

Resultado
Nada para mostrar ainda

Como funciona

Percent-encoding replaces each byte that is not an unreserved character with a percent sign followed by two uppercase hex digits. RFC 3986 splits the ASCII set into unreserved characters (A-Z, a-z, 0-9, hyphen, period, underscore, tilde) which are never encoded, reserved characters (: / ? # [ ] @ ! $ and the like) which have structural meaning and are encoded only when used as data, and everything else, which is always encoded. The space is a special case: it is legal as %20 in every context, whereas the plus sign for space is only correct inside application/x-www-form-urlencoded bodies.

Encode-component and encode-URI are not interchangeable, and mixing them up is the classic mistake. Encoded as a full URI, https://example.com/a b keeps its scheme, slashes and question mark intact and becomes https://example.com/a%20b. Encoded as a component, the same input becomes https%3A%2F%2Fexample.com%2Fa%20b, because the slashes and colon are data now. If a URL arrives at your server with %3A%2F%2F in it, something on the client called the wrong function.

HTML entity encoding is a different problem entirely. In HTML, the characters &, <, >, quote and apostrophe are structural: an unescaped < opens a tag, an unescaped & begins an entity reference, and an unescaped quote inside an attribute ends the attribute early. Escaping them turns markup into inert text. This is exactly the mechanism that stops cross-site scripting — a comment containing a script tag is displayed as characters rather than executed — which is why every template engine escapes by default and why bypassing that default with a raw-HTML helper is so often the source of a vulnerability.

The decoder side is stricter than most. A percent sign not followed by two hex digits is not a decodable sequence, and silently leaving it alone hides corruption; this tool reports the position instead. HTML entities are resolved for the full named set plus numeric decimal and hexadecimal references, so both &amp; and &#38; and &#x26; decode to the same ampersand. Round-tripping is checked, so you can confirm that decode-then-encode returns your original input byte for byte.

Casos de uso comuns

  • Build a query string by hand and encode a search term that contains spaces, ampersands or non-Latin characters.
  • Look at a tracking URL that has been encoded twice and work out what the real destination is.
  • Escape user-supplied text before pasting it into an HTML template or an email body.
  • Decode an OAuth redirect_uri parameter to find out why the authorization server rejects it.
  • Turn a URL parameter that contains a nested URL into its encoded form for a callback or webhook configuration.
  • Confirm that a value you are about to write into an attribute cannot break out of the quotes.

Última atualização: 2026-10-14 — o corpo do artigo é exibido em inglês; a interface está traduzida.

Perguntas frequentes

Should a space be %20 or +?

It depends on context. In the path, the query string of a URL used for routing, or any RFC 3986 context, a space is %20 — the plus sign there is a literal plus. In a form submission with the application/x-www-form-urlencoded content type, a plus means a space, and using %20 still works but is unusual. When in doubt use %20: it is correct everywhere, while + is only correct in a form body.

How does HTML escaping prevent cross-site scripting?

XSS happens when text supplied by an attacker is parsed as markup rather than displayed as characters. Escaping converts the five structural characters — ampersand, less-than, greater-than, double quote and apostrophe — into entity references, so a script tag in a comment becomes a sequence of visible characters instead of an executing element. It is not sufficient on its own: the escaping must match the context, since a value placed inside a JavaScript string or a URL attribute needs a different treatment than one placed in element content.

Why is my URL encoded twice?

Almost always because an already-encoded string was passed to an encoder a second time, turning the percent sign itself into %25. A URL containing %2520 was encoded twice — the outer layer decoded once gives %20, which decodes to a space. Double encoding is common in redirect chains and in systems where a proxy re-encodes a URL it received, so when a parameter looks wrong, decode it once and look at whether a second layer remains.

Is it safe to paste production URLs into this tool?

Yes. Every conversion runs in JavaScript inside your browser and nothing is sent over the network — there is no API call behind the Encode button. That said, a URL can still contain secrets such as API keys, signed tokens or session identifiers, and those end up in your browser history and clipboard if you copy the result. Treat a signed URL as a credential regardless of which tool you use to inspect it.

Ferramentas relacionadas