URL Encoding in C# — `HttpUtility.UrlEncode` vs `WebUtility.UrlEncode`

Q: What is the difference between `HttpUtility.UrlEncode` and `WebUtility.UrlEncode` in C#?

`HttpUtility.UrlEncode` follows form-urlencoded rules (spaces become `+`, lowercase hex). `WebUtility.UrlEncode` follows RFC 3986 (spaces become `%20`, uppercase hex). Use `WebUtility.UrlEncode` for REST APIs. It produces standard percent-encoding with `%20` for spaces.

Q: How do I decode form data in C#?

Use `HttpUtility.UrlDecode` for form data. It handles both `+` (as space) and `%20` (as space).

Q: Does `WebUtility.UrlDecode` convert `+` to space?

No. `WebUtility.UrlDecode` only decodes percent-encoding. Use `HttpUtility.UrlDecode` if you need `+` decoded as space.

Q: How do I build a query string in C#?

Use `HttpUtility.ParseQueryString("")` to create a `NameValueCollection`, add parameters, and call `ToString()`. `System.Web` — available in both .NET Framework and .NET Core via the `System.Web.HttpUtility` NuGet package. --- C# provides two URL encoding methods because they serve different purposes. `HttpUtility.UrlEncode` comes from the ASP.NET form encoding heritage, while `WebUtility.UrlEncode` was added for modern RFC 3986 compliance. The safest rule for C# is: use `WebUtility.UrlEncode` for everything unless you specifically need form-urlencoded output (POST form data). For decoding, use `HttpUtility.UrlDecode` if you expect `+` as a space, and `WebUtility.UrlDecode` for strict percent-encoding. For quick cross-referencing during development, the [URL Encoder/Decoder](/url-encode-decode) tool helps verify how each C# method encodes your data. ---

C# gives you two standard library options for URL encoding:

using System.Web;
using System.Net;

At first glance, they look like they do the same thing. They do not.

HttpUtility.UrlEncode("hello world");
// Result: hello%2bworld

WebUtility.UrlEncode("hello world");
// Result: hello%20world

The differences in space handling, plus sign encoding, and uppercase vs lowercase hex digits create real bugs in production APIs, especially when interacting with services that expect specific encoding conventions.

This guide covers both methods, explains the differences, and provides patterns for correct encoding in ASP.NET, .NET Core, and console applications.

The Two Encoding Methods

`HttpUtility.UrlEncode`

using System.Web;

string encoded = HttpUtility.UrlEncode("hello world");
Console.WriteLine(encoded);
// hello%2bworld

Wait — hello%2bworld? The space became %2b (which is +)? No. Let me be precise:

HttpUtility.UrlEncode("hello world")
// Produces: hello%2bworld  ← Wait, that is not right either

Actually, let me clarify exactly what each method does:

HttpUtility.UrlEncode("hello world");
// Result: hello+world
// Space becomes +, literal + becomes %2b

WebUtility.UrlEncode("hello world");
// Result: hello%20world
// Space becomes %20, literal + stays as +

The confusion comes from how UrlEncode in the full .NET Framework vs .NET Core handles these cases. Let me show the actual behavior with concrete code.

Behavior Comparison

using System;
using System.Web;
using System.Net;

class Program
{
    static void Main()
    {
        string[] testCases = {
            "hello world",
            "C++",
            "hello & goodbye",
            "50% off",
            "john@example.com",
            "a=b",
            "東京",
            ""
        };

        foreach (var test in testCases)
        {
            var httpEncoded = HttpUtility.UrlEncode(test);
            var webEncoded = WebUtility.UrlEncode(test);

            Console.WriteLine($"Input: \"{test}\"");
            Console.WriteLine($"  HttpUtility:  {httpEncoded}");
            Console.WriteLine($"  WebUtility:   {webEncoded}");
            Console.WriteLine();
        }
    }
}

Output:

Input: "hello world"
  HttpUtility:  hello+world
  WebUtility:   hello%20world

Input: "C++"
  HttpUtility:  C%2b%2b
  WebUtility:   C%2B%2B

Input: "hello & goodbye"
  HttpUtility:  hello+%26+goodbye
  WebUtility:   hello%20%26%20goodbye

Input: "50% off"
  HttpUtility:  50%25+off
  WebUtility:   50%25%20off

Input: "john@example.com"
  HttpUtility:  john%40example.com
  WebUtility:   john%40example.com

Input: "a=b"
  HttpUtility:  a%3db
  WebUtility:   a%3Db

Input: "東京"
  HttpUtility:  %e6%9d%b1%e4%ba%ac
  WebUtility:   %E6%9D%B1%E4%BA%AC

Input: ""
  HttpUtility:
  WebUtility:

Three key differences:

Space encoding: HttpUtility uses +, WebUtility uses %20
Plus sign encoding: HttpUtility encodes + as %2b (lowercase), WebUtility encodes as %2B (uppercase)
Hex case: HttpUtility uses lowercase hex (%e6), WebUtility uses uppercase (%E6)

Why This Matters

API Compatibility

Some APIs expect %20 for spaces. Sending + can cause signature validation failures, incorrect parameter parsing, or silent data corruption.

// If the API expects RFC 3986 encoding:
HttpUtility.UrlEncode(value);  // May fail — uses + for spaces

// Use WebUtility.UrlEncode for RFC 3986
WebUtility.UrlEncode(value);   // Uses %20 for spaces

OAuth and Signed URLs

OAuth providers and signed URL systems often use the exact encoded value for signature computation. Different encoding produces different signatures.

string redirectUri = "https://myapp.com/callback?state=abc";

// HttpUtility produces lowercase hex
var httpEncoded = HttpUtility.UrlEncode(redirectUri);
// https%3a%2f%2fmyapp.com%2fcallback%3fstate%3dabc

// WebUtility produces uppercase hex
var webEncoded = WebUtility.UrlEncode(redirectUri);
// https%3A%2F%2Fmyapp.com%2Fcallback%3Fstate%3Dabc

If the OAuth provider expects uppercase hex and your code produces lowercase, the signature check fails with no clear error message.

Encoding Query Parameters

Building a Query String with `HttpUtility`

using System.Web;
using System.Collections.Specialized;

var query = HttpUtility.ParseQueryString("");
query["q"] = "hello world";
query["category"] = "books & media";
query["page"] = "1";

string url = $"https://example.com/search?{query}";
Console.WriteLine(url);

Output:

https://example.com/search?q=hello+world&category=books+%26+media&page=1

HttpUtility.ParseQueryString creates a NameValueCollection that uses HttpUtility.UrlEncode internally when serialized.

Building with `WebUtility`

WebUtility does not provide a query string builder. You need to build it manually:

using System.Net;
using System.Text;

var parameters = new Dictionary<string, string>
{
    ["q"] = "hello world",
    ["category"] = "books & media",
    ["page"] = "1"
};

var parts = parameters.Select(p =>
    $"{WebUtility.UrlEncode(p.Key)}={WebUtility.UrlEncode(p.Value)}");

string queryString = string.Join("&", parts);
string url = $"https://example.com/search?{queryString}";

Console.WriteLine(url);

Output:

https://example.com/search?q=hello%20world&category=books%20%26%20media&page=1

Encoding in ASP.NET

ASP.NET Core

In ASP.NET Core, model binding handles decoding automatically:

[ApiController]
[Route("search")]
public class SearchController : ControllerBase
{
    [HttpGet]
    public IActionResult Search([FromQuery] string q)
    {
        // q is already decoded — %20 and + are both handled
        return Ok(new { query = q });
    }
}

Encoding Outgoing Requests from ASP.NET

When making outgoing HTTP requests from ASP.NET, use WebUtility.UrlEncode for REST APIs and HttpUtility.UrlEncode for form submissions:

using System.Net;
using System.Net.Http;

public class ApiService
{
    private readonly HttpClient _httpClient;

    public ApiService(HttpClient httpClient)
    {
        _httpClient = httpClient;
    }

    public async Task<string> SearchAsync(string query)
    {
        var encoded = WebUtility.UrlEncode(query);
        var response = await _httpClient.GetAsync(
            $"https://api.example.com/search?q={encoded}");

        return await response.Content.ReadAsStringAsync();
    }
}

Decoding in C#

`HttpUtility.UrlDecode`

using System.Web;

string decoded = HttpUtility.UrlDecode("hello+world");
Console.WriteLine(decoded);
// hello world

decoded = HttpUtility.UrlDecode("hello%20world");
Console.WriteLine(decoded);
// hello world

HttpUtility.UrlDecode handles both + and %20 as spaces.

`WebUtility.UrlDecode`

using System.Net;

string decoded = WebUtility.UrlDecode("hello%20world");
Console.WriteLine(decoded);
// hello world

decoded = WebUtility.UrlDecode("hello+world");
Console.WriteLine(decoded);
// hello+world  ← NOTE: does NOT decode + as space!

WebUtility.UrlDecode only decodes percent-encoding. It does NOT convert + to space.

This difference is important when processing incoming form data.

When to Use Which

Scenario	Use
Building URLs for REST APIs	`WebUtility.UrlEncode`
Building form data (POST bodies)	`HttpUtility.UrlEncode`
Encoding OAuth redirect URIs	`WebUtility.UrlEncode`
Encoding query parameters for external APIs	`WebUtility.UrlEncode`
Encoding values for signed URLs	`WebUtility.UrlEncode`
ASP.NET model binding	Framework handles automatically
Decoding form input	`HttpUtility.UrlDecode` (handles `+`)
Decoding URL parameters	`WebUtility.UrlDecode` (strict percent)

Common C# Encoding Mistakes

Mistake 1: Using `HttpUtility.UrlEncode` for API Parameters

// Problem
var encoded = HttpUtility.UrlEncode("hello world");
// Result: hello+world — some APIs reject this

// Fix
var encoded = WebUtility.UrlEncode("hello world");
// Result: hello%20world — RFC 3986 compliant

Mistake 2: Using the Wrong Decode Method

// Problem: webUtility does NOT decode + as space
var decoded = WebUtility.UrlDecode("hello+world");
// Result: hello+world

// Fix: use HttpUtility.UrlDecode for form data
var decoded = HttpUtility.UrlDecode("hello+world");
// Result: hello world

Mistake 3: Double Encoding

var value = "hello world";
var once = WebUtility.UrlEncode(value);   // hello%20world
var twice = WebUtility.UrlEncode(once);   // hello%2520world

Mistake 4: Forgetting to Handle Empty or Null Values

string value = null;
var encoded = WebUtility.UrlEncode(value);
// Returns empty string — but some APIs expect "null" or nothing

// Better
var encoded = value != null ? WebUtility.UrlEncode(value) : "";

URI Class Alternative

.NET also provides the System.Uri class, which can encode URI components:

var uri = new Uri("https://example.com/search?q=hello world");
Console.WriteLine(uri.AbsoluteUri);
// https://example.com/search?q=hello%20world

But Uri does not encode all special characters:

var uri = new Uri("https://example.com/search?q=hello & world");
Console.WriteLine(uri.AbsoluteUri);
// https://example.com/search?q=hello%20&%20world
// NOTE: & is NOT encoded — this is broken

So Uri is not reliable for encoding query parameter values.

Testing URL Encoding in C#

using Xunit;

public class UrlEncodingTests
{
    [Theory]
    [InlineData("hello world", "hello%20world")]
    [InlineData("C++", "C%2B%2B")]
    [InlineData("50% off", "50%25%20off")]
    [InlineData("", "")]
    [InlineData("hello", "hello")]
    public void WebUtility_UrlEncode_ProducesExpectedResults(
        string input, string expected)
    {
        var result = WebUtility.UrlEncode(input);
        Assert.Equal(expected, result);
    }

    [Fact]
    public void RoundTrip_PreservesOriginalValue()
    {
        var original = "hello world & 東京 50% off C++";
        var encoded = WebUtility.UrlEncode(original);
        var decoded = WebUtility.UrlDecode(encoded);
        Assert.Equal(original, decoded);
    }

    [Fact]
    public void HttpUtility_DecodesPlusAsSpace()
    {
        var decoded = HttpUtility.UrlDecode("hello+world");
        Assert.Equal("hello world", decoded);
    }
}

Best Practices for C# URL Encoding

Prefer `WebUtility.UrlEncode` for API Work

WebUtility.UrlEncode(value);  // RFC 3986 compliant

Use `HttpUtility.ParseQueryString` for Building Query Strings

var query = HttpUtility.ParseQueryString("");
query["key"] = value;
string url = $"{base}?{query}";

Use `HttpUtility.UrlDecode` for Incoming Form Data

string formValue = HttpUtility.UrlDecode(rawValue);

Use `WebUtility.UrlDecode` for URL Parameters

string urlParam = WebUtility.UrlDecode(encodedParam);

Avoid `Uri` for Encoding Values

The Uri class does not reliably encode all special characters.

Normalize Encoding Early

If your application receives data that may be encoded in either format, normalize it early:

string normalized = WebUtility.UrlDecode(
    HttpUtility.UrlDecode(rawInput)
);

Related Resources

For more on encoding across platforms and common pitfalls:

Common URL Encoding Mistakes Developers Keep Making Common Mistakes
How to Encode a URL in JavaScript JavaScript URL Encoding
Java URL Encoding — URLEncoder vs URI Java URL Encoding
Double URL Encoding — How It Happens Double URL Encoding

FAQ

What is the difference between `HttpUtility.UrlEncode` and `WebUtility.UrlEncode` in C#?

HttpUtility.UrlEncode follows form-urlencoded rules (spaces become +, lowercase hex). WebUtility.UrlEncode follows RFC 3986 (spaces become %20, uppercase hex).

Which C# encoding method should I use for REST APIs?

Use WebUtility.UrlEncode for REST APIs. It produces standard percent-encoding with %20 for spaces.

Why does `HttpUtility.UrlEncode` use lowercase hex?

Historical compatibility with ASP.NET form encoding conventions. WebUtility.UrlEncode was introduced later with RFC 3986 compliance.

How do I decode form data in C#?

Use HttpUtility.UrlDecode for form data. It handles both + (as space) and %20 (as space).

Does `WebUtility.UrlDecode` convert `+` to space?

No. WebUtility.UrlDecode only decodes percent-encoding. Use HttpUtility.UrlDecode if you need + decoded as space.

How do I build a query string in C#?

Use HttpUtility.ParseQueryString("") to create a NameValueCollection, add parameters, and call ToString().

Which namespace do I need for `HttpUtility.UrlEncode`?

System.Web — available in both .NET Framework and .NET Core via the System.Web.HttpUtility NuGet package.

Final Thoughts

C# provides two URL encoding methods because they serve different purposes. HttpUtility.UrlEncode comes from the ASP.NET form encoding heritage, while WebUtility.UrlEncode was added for modern RFC 3986 compliance.

The safest rule for C# is: use WebUtility.UrlEncode for everything unless you specifically need form-urlencoded output (POST form data). For decoding, use HttpUtility.UrlDecode if you expect + as a space, and WebUtility.UrlDecode for strict percent-encoding.

For quick cross-referencing during development, the URL Encoder/Decoder tool helps verify how each C# method encodes your data.

URL Encoding in C# — HttpUtility.UrlEncode vs WebUtility.UrlEncode

The Two Encoding Methods

HttpUtility.UrlEncode

Behavior Comparison

Why This Matters

API Compatibility

OAuth and Signed URLs

Encoding Query Parameters

Building a Query String with HttpUtility

Building with WebUtility

Encoding in ASP.NET

ASP.NET Core

Encoding Outgoing Requests from ASP.NET

Decoding in C#

HttpUtility.UrlDecode

WebUtility.UrlDecode

When to Use Which

Common C# Encoding Mistakes

Mistake 1: Using HttpUtility.UrlEncode for API Parameters

Mistake 2: Using the Wrong Decode Method

Mistake 3: Double Encoding

Mistake 4: Forgetting to Handle Empty or Null Values

URI Class Alternative

Testing URL Encoding in C#

Best Practices for C# URL Encoding

Prefer WebUtility.UrlEncode for API Work

Use HttpUtility.ParseQueryString for Building Query Strings

Use HttpUtility.UrlDecode for Incoming Form Data

Use WebUtility.UrlDecode for URL Parameters

Avoid Uri for Encoding Values

Normalize Encoding Early

Related Resources

FAQ

What is the difference between HttpUtility.UrlEncode and WebUtility.UrlEncode in C#?

Which C# encoding method should I use for REST APIs?

Why does HttpUtility.UrlEncode use lowercase hex?

How do I decode form data in C#?

Does WebUtility.UrlDecode convert + to space?

How do I build a query string in C#?

Which namespace do I need for HttpUtility.UrlEncode?

Final Thoughts

URL Encoding in C# — `HttpUtility.UrlEncode` vs `WebUtility.UrlEncode`

`HttpUtility.UrlEncode`

Building a Query String with `HttpUtility`

Building with `WebUtility`

`HttpUtility.UrlDecode`

`WebUtility.UrlDecode`

Mistake 1: Using `HttpUtility.UrlEncode` for API Parameters

Prefer `WebUtility.UrlEncode` for API Work

Use `HttpUtility.ParseQueryString` for Building Query Strings

Use `HttpUtility.UrlDecode` for Incoming Form Data

Use `WebUtility.UrlDecode` for URL Parameters

Avoid `Uri` for Encoding Values

What is the difference between `HttpUtility.UrlEncode` and `WebUtility.UrlEncode` in C#?

Why does `HttpUtility.UrlEncode` use lowercase hex?

Does `WebUtility.UrlDecode` convert `+` to space?

Which namespace do I need for `HttpUtility.UrlEncode`?