7 min read · Try URL Encoder
What must be encoded
Redirect URIs, state parameters, and scope strings often contain characters that break URL parsing if left raw. Encode each query value separately—do not encode the entire URL as one blob unless you know the parser expects it.
Plus vs %20
In query strings, spaces may appear as `+` or `%20` depending on library and server. Be consistent within your app; mixed decoding rules cause “invalid redirect_uri” errors that are hard to spot.
Unicode and IRIs
International domain names and UTF-8 in paths need proper encoding. Test with non-ASCII state values if your product supports global users.
Debugging failed OAuth flows
When providers reject a redirect, decode both the registered URI and the sent URI side by side in a URL decoder. One trailing slash or encoded slash (`%2F`) mismatch is a frequent culprit.
This article is part of the DevToolsHub learning guides—original writing meant to complement our free tools, not replace official documentation from vendors or standards bodies.