query-string.txt — 2 tools ● LIVE
Input · raw 0 CHARS
NETWORK PAYLOAD: 0 BYTES · PROCESSING: LOCAL
Output · converted 0 CHARS
READ-ONLY · UPDATES ON EVERY KEYSTROKE
Characters in0RAW TEXT
Characters out0PERCENT-SAFE
Chars encoded0TURNED INTO %XX
Encoding modeCOMPONENTCOMPONENT · URI · FORM

Developer Tools · Group 06 of 19

URL Tools.

Two machines for the web's oldest trick — percent-encoding. The encoder turns spaces, ampersands, Persian text and emoji into %XX bytes that survive any query string, in three modes: component for single values, full-URI for whole addresses, form for POST bodies. The decoder turns them back — rejoining UTF-8 byte runs, treating + as space, and counting every malformed % it refuses to touch instead of throwing. Nothing is uploaded, nothing is stored.

  • Tools02
  • Encodinglive
  • Uploads0
  • Backendnone
  • Costfree
In order, 01 → 02

Two machines, one byte-level engine, zero servers.

( 01 )

Converts text into percent-encoded UTF-8, one %XX group per byte, with three personalities you can cycle from the deck. Component mirrors encodeURIComponent — everything except letters, digits and - _ . ! ~ * ' ( ) is escaped, so &, =, ? and # are all neutralized inside a single query value. Full URI mirrors encodeURI — the URL's own skeleton (: / ? # [ ] @ & = +) survives while spaces and non-ASCII characters get escaped. Form follows the W3C form rules — space becomes +, and almost everything else is escaped. Persian letters become two-byte runs, the telescope emoji becomes four, and the Chars encoded stat counts every character that had to change.

Example · component mode

night sky & stars = 100%

night%20sky%20%26%20stars%20%3D%20100%25 & and = are escaped — safe inside any query value.

Use it for query stringsAPI parametersdeep linkscookies

The trip home. The decoder walks the input character by character, collects runs of %XX groups into byte buffers and reassembles them as UTF-8 — so ten hex groups become one Persian word and four become a telescope. With the ⊞ plus → space toggle on, + is read the way form-encoded query strings write it; flip it off when your data carries literal plus signs. And it never throws: a % that isn't followed by two hex digits passes through exactly as written and is counted in the Left as-is stat, so you always know precisely how much of the input didn't decode.

Example

tags=%D8%B3%D8%AA%D8%A7%D8%B1%D9%87%2C%D9%85%D8%A7%D9%87&oops=%ZZ

tags=ستاره,ماه&oops=%ZZ 10 sequences joined into Persian · %ZZ left as-is and counted.

Use it for encoded dumpsredirect debuggingOAuth callbacksanalytics URLs

Encoding rules · both tools work at the UTF-8 byte level — every non-ASCII character becomes two to four %XX groups, one per byte · component mode mirrors encodeURIComponent: everything except A–Z a–z 0–9 and - _ . ! ~ * ' ( ) is escaped, so & = ? # / are safe inside a value · full-URI mode mirrors encodeURI: the URL's own structure (: / ? # [ ] @ & = +) survives, spaces and non-ASCII don't · form mode follows the W3C form rules — space becomes +, almost everything else is escaped · the decoder rejoins multi-byte sequences, treats + as space while the toggle is on, and never throws — malformed % sequences pass through untouched and are counted in Left as-is · round trips are lossless: encode then decode and you're home · ⇄ Output → Input feeds any result straight back for the return trip

The privacy promise

Paste anything. We couldn't read it even if we wanted to.

This page has no backend and no database. Every byte percent-encoded, every sequence rejoined and every malformed % counted just now was computed by JavaScript inside your own browser tab — your data never traveled a single centimeter of cable. Close the page and it's gone for good.

✕ SERVER · DATABASE · LOGS · ANALYTICS
  • Databasenull
  • Backendnone
  • Data uploads0
  • Session logs0
Questions

Asked often, answered plainly.

( 02 )
What's the difference between the three encoding modes?

Component mode mirrors encodeURIComponent: everything except A–Z, a–z, 0–9 and - _ . ! ~ * ' ( ) is escaped, so & = ? # / all become safe inside a single query value — use it for parameter values. Full-URI mode mirrors encodeURI: the URL's own structure characters (: / ? # [ ] @ & = +) survive while spaces and non-ASCII characters are escaped — use it for whole addresses. Form mode follows the W3C form-encoding rules: spaces become + and almost everything else is percent-escaped — use it for POST bodies and query strings built the classic way.

Why does my Persian text or emoji become so many %XX groups?

Because percent-encoding works at the byte level, and UTF-8 uses two to four bytes for every non-ASCII character. س becomes two groups (%D8%B3), the Persian word ستاره becomes ten, and the telescope emoji becomes four (%F0%9F%94%AD). The decoder rejoins those byte runs back into single characters, so the round trip is completely lossless — nothing is approximated, nothing is dropped.

Is a + a space or a plus sign?

In query strings written with form encoding, + means space — that's the convention the decoder follows while the ⊞ plus → space toggle is on. If your data contains literal plus signs, turn the toggle off before decoding. And when encoding, use component mode for values: it escapes a real + to %2B, so it can never be mistaken for a space on the way back.

What happens with malformed sequences like %ZZ?

The decoder never throws. A % that isn't followed by two hexadecimal digits is passed through exactly as written and counted in the Left as-is stat, so you can see at a glance how much of the input didn't decode. Likewise, byte runs that don't form valid UTF-8 fall back to single-byte decoding instead of failing, and the verdict flips live as you fix the input.

Is my data saved anywhere?

No. IrisTool has no backend and no database. Encoding happens inside your browser tab and the data disappears the moment you close or refresh the page. There is nothing to leak, because nothing is ever collected.