Skip to main content
Yoryantra
Home/Tools
← Back to Tools

Percent Encoding Analyzer

Trace percent escapes, UTF-8 byte runs, malformed sequences, reserved characters, and query plus semantics.

Input is analyzed exactly as pasted, including leading or trailing spaces. Percent escapes are byte values, so a single Unicode character may span several %XX sequences.

Interpretation settings

For a full URL, plus-to-space applies only inside the query portion. A literal plus in the path is left alone.

Output

Percent-encoding analysis output will appear here.
Analysis runs in your browser and does not request the pasted URL. That means redirects, server routing, proxy normalization, framework decoding, and application behavior are not executed or reproduced.

A percent escape represents one byte

RFC 3986 writes a percent-encoded octet as % followed by two hexadecimal digits. ASCII characters fit in one byte, but UTF-8 text often needs several bytes. For example, %C3%A9 is one UTF-8 character made from two percent-encoded bytes; treating each byte as an independent character produces misleading mojibake.

The byte table therefore labels non-ASCII octets as UTF-8 bytes and validates consecutive percent-byte runs separately. Tolerant decode preserves invalid UTF-8 escapes rather than inserting replacement characters that could hide corruption.

Component boundaries must be known before reserved bytes are decoded

Characters such as /, ?, #, &, and = can delimit URL structure. RFC 3986 warns that decoding a reserved character before the URI has been split into its components can turn data into syntax. That is why decodeURI and decodeURIComponent intentionally behave differently.

Decoding a complete URL with component-style rules can expose reserved delimiters such as an encoded slash or ampersand. Analyze the component you actually intend to decode rather than repeatedly decoding the whole URL.

Plus-to-space is form parsing, not percent decoding

A literal + is not a percent escape. The HTML/URL form-encoding algorithm uses plus as a representation of space when parsing application/x-www-form-urlencoded data. A plus in a path remains a plus. When full-URL mode is selected here, plus-to-space is limited to the query portion so path data is not rewritten accidentally.

Malformed escape

A bare percent sign, %G1, or an incomplete triplet is not valid percent encoding. Strict JavaScript URI decoders throw a URIError for malformed syntax.

Valid escapes, invalid UTF-8

%FF is syntactically a valid percent-encoded byte, but it is not valid standalone UTF-8. URI component decoders can therefore reject input whose %XX syntax looks correct.

Double decoding can change meaning

%252F becomes %2F after one decode and / after a second. RFC 3986 explicitly cautions against encoding or decoding the same string more than once. Differences between proxies, routers, web frameworks, and application code are a common reason encoded delimiters become security-sensitive.

Standards behind the analysis

RFC 3986 defines percent-encoded octets, reserved and unreserved URI characters, and the warning about decoding before component boundaries are known. The living WHATWG URL Standard defines browser URL percent-encode sets and the form-urlencoded parser used for modern query/form behavior.