safepaste url

URL encoder and decoder

Paste into either side. Text is encoded or decoded directly in this tab, and an address is taken apart into its parameters. None of it is sent anywhere.

Text

Encoded

Encode as

What happens to what you paste

Nothing. It is converted in this browser tab and then it is gone when you close the tab. SafePaste has no account, no database and no analytics, so there is nothing for it to be stored in.

This is enforced, not promised

The page includes a Content Security Policy of connect-src 'none'. That makes fetch, XMLHttpRequest, WebSocket, EventSource and sendBeacon fail in the browser itself, whatever the code on this page tries to do. Images and fonts are restricted to data that is already inside the file, and form-action 'none' prevents all form submission.

You do not have to take our word for it. Open your browser's developer tools, watch the Network tab while you use the page, and confirm that it stays empty after the page itself has loaded.

What the host can see

This page is served by Cloudflare Pages. Like any web server, it sees the request for the page itself: an IP address, a user agent, a timestamp. That happens before any of this page's code runs and it is the same for every website you visit. What it does not see is anything you paste, because nothing you paste is ever part of a request. That includes any address you paste here: it is taken apart in this tab, and nothing in it is visited, looked up or turned into a link.

No cookies, no storage, no trackers

The two links that leave

The footer links to Flytrap Industries and to a Stripe donation page. Neither is contacted unless you click it. They carry no query string and no referrer, so following one tells the destination nothing about what you were doing here. If you do donate, Stripe handles that payment under its own privacy policy and SafePaste never sees your card details.

Working offline

Save this page to disk and open it again. It is a single self-contained file, so it works with no network at all, including on a machine that has never been connected to one.

This policy describes the page you are reading. It is part of the same file, so the copy you save to disk carries it too.

How URL encoding works

A web address can only be written with a small set of characters: English letters, digits and a few punctuation marks. Some of those marks also give the address its structure. / separates the path, ? starts the query, & and = split it into parameters, and # starts the fragment. Percent-encoding is how everything else gets in, including those same marks when they are meant as part of a value.

A character becomes bytes, and each byte becomes three characters

A character that cannot appear as itself is written as its bytes in UTF-8, each one as a % followed by two hexadecimal digits. A space is the single byte 20, so it becomes %20. Letters outside English take between two and four bytes each.

café becomes caf%C3%A9.

Which characters are safe

Letters, digits, and the four marks - . _ ~ never need encoding. RFC 3986, the standard that defines web addresses, calls them unreserved. Every other character either has a structural job in an address or is not allowed in one at all, so it is encoded whenever it is part of a value.

The three ways this page encodes

Plus or space

In a query string, + means a space, because that is how forms have always sent them. Everywhere else in an address it is a plus sign. So a + in something you paste is ambiguous. This page says which way it read it, and lets you switch with one click. A real plus sign inside a value is written %2B.

Decode the parameters, not the whole address

Decoding a whole address in one go loses information. In ?next=%2Fhome%3Fa%3D1%26b%3D2 there is one parameter, and its value is itself an address. Once decoded, that value's ? and & look exactly like the real ones. So this page splits an address into its parameters first and decodes each one separately. They are shown in a table under the controls, where you can edit them and have the address put back together.

A few more things worth knowing