Blog

TL;DR: Raw spaces, ampersands, and non-ASCII in query values break when pasted into tickets, Slack, or email clients. Encode parameter values, keep delimiters literal, and decode only when inspecting. A quick pass through a dev utility toolkit prevents “works on my machine” links that 404 for everyone else.

Where unencoded links silently rot

Support engineers copy a failing request URL from a browser bar or proxy log. The local browser already encoded it; the visible address bar may re-display decoded characters. Pasting that human-friendly form into Markdown or a CRM field can split the query at an ampersand inside a value, drop a hash fragment, or turn a plus into a space on the next hop.

Mobile chat apps are especially aggressive: they autolink until the first space, then leave the rest as plain text. Recipients click a truncated URL and swear the API “lost” parameters you actually typed.

Encode values, not the whole kitchen sink

Correct query construction treats structure and payload differently:

• Keep ?, &, and = as syntax between pairs.
• Percent-encode characters inside each value (and keys if they are dynamic).
• Do not double-encode: %20 should not become %2520 unless a gateway truly requires it.
• Prefer %20 for spaces in modern APIs; remember that + means space only in application/x-www-form-urlencoded bodies and some query parsers.

If you encode the entire URL including https://, you get a useless string. If you encode nothing, nested & inside a filter expression chops the query early.

Unicode and emoji in search terms

Internationalized query text must become UTF-8 percent-bytes. Pasting raw emoji into a ticket may look fine in one client and corrupt in another. Encode before share; decode when a human needs to read the term.

Fragments, redirects, and login wrappers

Everything after # is a fragment: browsers do not send it to servers. Debug links that rely on hash routes still need encoding inside the fragment for client routers, but never assume a backend log will show those characters. OAuth redirect URIs add another layer—those redirect values are often themselves URL-encoded parameters. Count the layers before you declare the IdP “broken.”

A ticket-ready workflow

When attaching a repro link:

• Copy from a tool that shows the wire form, or rebuild from params with an encoder.
• Wrap the URL in backticks or angle brackets in Markdown so clients do not autolink mid-query.
• Redact secrets: encoding is not encryption. Access tokens in query strings should be rotated, not pretty-printed into public channels.
• Include the HTTP method and whether the failing call was GET versus a POST with a query.

For POST bodies, do not shove JSON into the query string “so it fits in a URL.” Use a sanitized body sample instead.

Decoding when you investigate

Decode once to read. If you still see %25 sequences, you may be looking at double encoding from a reverse proxy. Fix at the source that added the extra pass; repeatedly clicking “decode” in a loop hides which hop misbehaved.

Compare the encoded link against server access logs. Matching on the decoded string alone can miss cases where two different encodings normalize differently across stacks.

Team conventions that save hours

Agree that shared debug URLs are always in encoded wire form. Keep a short internal note listing which characters your API treats as delimiters inside filters. When onboarding, show one broken Slack paste and the fixed version—muscle memory beats a wiki paragraph.

Browser-based encoders on www.masters-tool.com are ideal for one-off ticket hygiene when you are outside the IDE. Use them for values you are about to share, then close the tab—do not turn encoding into a ritual for secrets that should never leave the vault.

Clean query encoding is unglamorous. It is also why half of “intermittent” link bugs disappear before anyone opens Wireshark.