> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/payload-encoding.md).

# Payload encoding

Build an encoding chain and inspect the bytes the application receives.

In the active profile editor, select a step and open **Original Request → Payload Encoding**. Choose a transformation from the list and click **Add**. Use **Up** and **Down** to set the order, or **Remove** to delete a transformation.

| Choice                              | Purpose                                                |
| ----------------------------------- | ------------------------------------------------------ |
| URL-encode key characters           | Encode the engine's selected URL-sensitive characters. |
| URL-encode all characters           | Percent-encode the payload broadly.                    |
| URL-encode all characters (Unicode) | Apply the supported Unicode URL encoding variant.      |
| HTML-encode key characters          | Encode HTML-sensitive characters.                      |
| HTML-encode all characters          | Apply HTML encoding broadly.                           |
| Base64-encode                       | Encode the payload as Base64.                          |

## Example chain

1. Select **Base64-encode** and click **Add**.
2. Select **URL-encode key characters** and click **Add**.
3. Confirm Base64 appears first; move it with **Up** if necessary.
4. Click **OK** to save the profile.

Order matters: Base64 followed by URL encoding differs from the reverse order. The separate **URL-Encode these characters** checkbox and text field apply selected-character URL encoding after the chain. Leave it unchecked when no extra encoding is intended.

Check the transmitted request, not just the editor's payload text. Parameter serialization and existing escapes can produce double encoding. A `%27` in a source payload might become `%2527` if encoded again.

Align matching with the representation the application reflects. Imported profiles may use payload or pre-encoded-payload matching; inspect those saved settings when reusing a detector. Unicode, character encoding and regex differences deserve a fixture in both engines before claiming portability.

Pro stores the chain in the exported `Encoder` field automatically; no JSON editing is needed.