URL Encoder / Decoder
Percent-encode text for safe use in a URL, or decode a percent-encoded URL back to readable text. Choose between component encoding for query values and full-URI encoding.
What is URL encoding?
URL encoding, properly called percent-encoding, writes a byte as % followed by two hexadecimal digits. It is defined in RFC 3986, section 2.1. Text is first converted to UTF-8 bytes, so a space becomes %20 and é becomes %C3%A9.
Encoding matters because some characters have a job in URL syntax. RFC 3986 calls them reserved: : / ? # [ ] @ separate the parts of a URL, and ! $ & ' ( ) * + , ; = often separate values. If a search term contains &, it must be sent as %26 or the server will read it as the start of a new parameter. The unreserved characters A–Z a–z 0–9 - . _ ~ never need encoding.
How to use the URL encoder and decoder
- Type or paste text into the Input pane, or load it with File or URL.
- Choose a Mode: Component (encodeURIComponent) for a single value, or Full URI (encodeURI) for a complete address.
- Click Encode or Decode. The mode applies to both.
- Use Copy, the copy icon in the Output header, or Download to save
url-result.txt. Clear empties both panes.
The two modes explained
The modes call JavaScript’s built-in functions, specified in the ECMAScript standard, so the result is what your own code would produce.
- Component (encodeURIComponent) encodes everything except letters, digits and
- _ . ! ~ * ' ( ). Use it for one query value, one path segment or one form field. Decoding in this mode turns every valid%XXsequence back into its character. - Full URI (encodeURI) also leaves
; , / ? : @ & = + $ #alone, so the structure of a URL survives while spaces and non-ASCII characters are encoded. Decoding in this mode keeps escapes that stand for those structural characters:q%3Dhello%20world%26x%3D1becomesq%3Dhello world%26x%3D1.
encodeURI vs encodeURIComponent
| Character | Component | Full URI |
|---|---|---|
| space | %20 | %20 |
& and = | %26, %3D | unchanged |
/ and ? | %2F, %3F | unchanged |
# | %23 | unchanged |
+ | %2B | unchanged |
% | %25 | %25 |
[ and ] | %5B, %5D | %5B, %5D |
é | %C3%A9 | %C3%A9 |
The rule of thumb: encode each piece of data with Component, then join the pieces with literal /, ?, & and =. Use Full URI only to tidy an address you already trust, for example one containing spaces.
Examples
| Input | Component | Full URI |
|---|---|---|
a&b=c | a%26b%3Dc | a&b=c |
100% sure? | 100%25%20sure%3F | 100%25%20sure? |
/path/to file.html | %2Fpath%2Fto%20file.html | /path/to%20file.html |
日本 | %E6%97%A5%E6%9C%AC | %E6%97%A5%E6%9C%AC |
😀 | %F0%9F%98%80 | %F0%9F%98%80 |
Encoding the whole of https://example.com/search?q=café & crème in Full URI mode gives https://example.com/search?q=caf%C3%A9%20&%20cr%C3%A8me. The & is still literal, so the server sees q with the value café followed by a separate, empty parameter named crème. Encoding just the value café & crème in Component mode gives caf%C3%A9%20%26%20cr%C3%A8me, which arrives intact.
Common problems and fixes
| Problem | Cause | Fix |
|---|---|---|
Decode shows Invalid percent-encoded input: | A % is not followed by two hex digits, or the bytes are not valid UTF-8. The rest of the message comes from your browser (Chromium says URI malformed; others word it differently). | Find the stray %; a literal percent sign must be written %25. |
+ signs stay in the decoded text | HTML form submissions (application/x-www-form-urlencoded) use + for a space; RFC 3986 decoding does not. | Replace + with a space before decoding, or use URLSearchParams in code. |
You see %2520 | The text was encoded twice: %20 became %2520. | Decode, copy the output into Input, and decode again. |
| A link stops working after encoding | A whole URL was encoded in Component mode, so :// became %3A%2F%2F. | Use Full URI mode, or encode only the values. |
A query value is cut off at & or # | The value was encoded in Full URI mode, which leaves those characters literal. | Encode the value in Component mode. |
Frequently asked questions
Should a space be encoded as %20 or +?
In a URL path always use %20. In a query string both appear: + comes from the form encoding described in the WHATWG URL Standard, while this tool and encodeURIComponent use %20. Servers that accept form data decode both, so %20 is the safer choice.
Why are ! ' ( ) and * not encoded?
encodeURIComponent treats them as safe, although RFC 3986 lists them as reserved. Most servers accept them literally. Systems that need strict RFC 3986 encoding, such as OAuth 1.0 signature bases, expect them as %21 %27 %28 %29 %2A, so replace them after encoding.
How are non-ASCII domain names encoded?
Not with percent-encoding. Host names use Punycode, so münchen.de becomes xn--mnchen-3ya.de, and only the path and query are percent-encoded. This tool does not convert host names; in JavaScript, new URL() does it for you.
Does uppercase or lowercase hex matter?
No. RFC 3986 treats %c3%a9 and %C3%A9 as the same, and both decode to é here. The RFC recommends uppercase when producing encoded text, which is what this tool outputs.
Is URL encoding a way to hide data?
No. Anyone can decode it instantly, and URLs end up in browser history, server logs and analytics. Never put passwords or tokens in a query string just because they are encoded.
Is my input sent to a server?
No. Encoding and decoding run in your browser. The only request the tool makes is when you click URL to load text, and that goes from your browser directly to the address you enter.
Guides
URL Encoding Explained: Percent-Encoding, encodeURIComponent and +
Which characters must be percent-encoded, encodeURI versus encodeURIComponent, + versus %20, double encoding and encoding in other languages.
Escaping HTML Correctly: Entities, Contexts and XSS
When and how to escape text for HTML, attributes, JavaScript and URLs, which entities matter, and why context-aware escaping prevents XSS.