Technical Guide to URL Percent-Encoding, RFC 3986, and HTML5 Entity Sanitization
Standardized by the IETF under RFC 3986 ("Uniform Resource Identifier: Generic Syntax") and maintained by the WHATWG URL Standard, percent-encoding represents arbitrary octets and characters within the restricted US-ASCII subset permitted in URLs. Concurrently, HTML entity encoding protects web applications against Cross-Site Scripting (XSS) by preventing untrusted strings from being interpreted as active DOM elements.
1. encodeURIComponent (Query Parameter Mode)
Escapes all characters except: A-Z a-z 0-9 - _ . ! ~ * ' ( ). Characters with structural roles such as &, =, ?, and / are encoded into percent triplets. Use this mode whenever encoding individual query parameter keys and values.
2. encodeURI (Complete URI Mode)
Escapes characters that are invalid in complete addresses while preserving protocol scheme separators, path hierarchies, and query markers: ; , / ? : @ & = + $ - _ . ! ~ * ' ( ) #. Use this mode when you have an entire URL string with non-ASCII characters in the pathname that you want to render valid without breaking the protocol or slashes.
RFC 3986 Character Classification Matrix
RFC 3986 divides the character universe into unreserved, reserved, and percent-encoded subsets:
Characters that have no reserved structural meaning in any URL scheme:
Characters reserved for grammar boundaries (schemes, paths, queries, fragments):
Space Encoding: RFC 3986 (%20) vs. Form-Urlencoded (+)
In generic URI syntax under RFC 3986, spaces are percent-encoded as %20. In contrast, the HTML specification for form submissions (application/x-www-form-urlencoded) encodes spaces as +. PrivaUtils provides a dedicated toggle to support both specifications.
HTML5 Character Entity Reference Matrix
When inserting dynamic content into HTML, raw characters must be replaced with entities to prevent XSS injection:
| Character | Named Entity | Decimal Entity | Hexadecimal Entity | Security Description |
|---|---|---|---|---|
| & | & | & | & | Entity reference delimiter |
| < | < | < | < | Tag opener |
| > | > | > | > | Tag closer |
| " | " | " | " | Attribute value quote |
| ' | ' | ' | ' | Single quote attribute delimiter |
| © | © | © | © | Copyright symbol |
| 🚀 | (none) | 🚀 | 🚀 | Astral plane Unicode emoji |
Implementation Guide by Programming Language
Standard methods for URL and HTML encoding across backend and database platforms:
| Language | URL Encode Method | URL Decode Method | HTML Encode Method |
|---|---|---|---|
| JavaScript | encodeURIComponent(s) | decodeURIComponent(s) | DOM / regex replace |
| Python | urllib.parse.quote(s) | urllib.parse.unquote(s) | html.escape(s) |
| C# (.NET) | Uri.EscapeDataString(s) | WebUtility.UrlDecode(s) | WebUtility.HtmlEncode(s) |
| PHP | rawurlencode($s) | rawurldecode($s) | htmlspecialchars($s) |
| Java | URLEncoder.encode(s, "UTF-8") | URLDecoder.decode(s, "UTF-8") | StringEscapeUtils.escapeHtml4 |
| SQL Server | FOR XML PATH('') | REPLACE / XML .value | FOR XML PATH |
Frequently Asked Questions (FAQ)
Does this tool support multi-byte Unicode strings and emojis?
Yes. All strings are processed using ECMAScript UTF-8 encoders and String.fromCodePoint(), guaranteeing that emojis, Cyrillic, Chinese Hanzi, and math symbols are properly percent-encoded into octet sequences and HTML entities without surrogate pair truncation.
How does PrivaUtils handle malformed percent-encoded sequences?
When input text contains an incomplete or invalid percent token (such as a trailing % or illegal hex digits), PrivaUtils identifies the exact character index and token marker, displaying an informative diagnostic rather than throwing an unhandled exception.
How does PrivaUtils save tool settings?
Your preferences (default mode, space format, line-by-line batch mode, and entity format) are stored in your browser's IndexedDB under the url-encoder-settings key. You can inspect, export, import, or clear them at any time in the Privacy Vault.