A query string with spaces and a UTF-8 city name will break the first naive concat. UrlShift percent-encodes and decodes URLs in the browser for query strings and paths. Use it when you are building a link by hand, debugging a 400 from a gateway, or peeling a double-encoded parameter. Do not use it as a URL shortener, a phishing checker, or a crawler. Encoding is not encryption. A percent-encoded password in a query is still a password in the server logs. Prefer POST bodies and headers for secrets. QRShift is next if the encoded URL needs to become a code on a poster.
Paste a raw string, encode, get %20 and %C3%A9. Decode goes back. encodeURIComponent vs encodeURI is the usual JS confusion: the former encodes more, which is what you want for a query value. If you encode an entire URL including https://, you get a mess that is only useful as a parameter. Do not then put that mess in the address bar and expect to navigate.
When not to use it: you needed a canonical URL, UTM builder, or IDN punycode expert panel. Also skip it if you were about to encode a 10 MB file (Base64Shift is the wrong sibling too). Plus vs %20 in query strings still depends on application/x-www-form-urlencoded. If decode looks wrong, try the other convention.
Privacy is local. Unreleased paths in a staging URL can be encoded without leaking to a 'url encoder' host. Still, do not paste a signed URL with a live token into a screenshot. Close the tab. A signed URL with a live token should not be screenshot into Slack after you debug it here.
City = 'São Paulo'. UrlShift encodes the value to S%C3%A3o%20Paulo. You append ?city= that. The API returns results. A second string was already encoded; you encoded again and got %25C3 — double encoding. You decode once and stop. A signed URL with a token is not pasted here; you edit locally in the address bar instead. Double encoding that produces %25C3 is the usual second paste; decode once and stop.
UrlShift encodes and decodes in the browser. Strings stay on the device. Signed URLs and tokens still become sensitive the moment they are on screen. Close the tab after debugging. Signed URLs and tokens become sensitive the moment they are on screen, local encoder or not.
Full policy: Shift Privacy Policy. Questions: [email protected].
You encoded the whole URL as a component. That is correct if it is a parameter. It is incorrect if you wanted to visit the link. Encode pieces, not the scheme, for navigation.
No. Percent-encoding is for URLs and query values. Base64 is for arbitrary bytes sitting in text. Different alphabets, different jobs, and mixing them is how a signed URL turns into an opaque blob nobody can open.
In query strings under form-urlencoded, + can mean space. In paths, %20 is the usual. Match the server. In form-urlencoded queries, plus can mean space; in paths, %20 is the usual contract with the server.
You can encode each value. It will not manage campaigns. A dedicated builder is a spreadsheet of UTM hygiene, not this box. UTM hygiene is a spreadsheet of campaign names; this box only encodes the values you already chose.
Related tools: SlugShift · QRShift · Base64Shift
Guides · All Shift tools · About · Contact