URL Encoder / Decoder
Percent-encode and decode URLs and URL components, UTF-8 safe.
How to use the URL Encoder
- 01
Paste your text or URL.
- 02
Choose encode or decode, and component or full-URL scope.
- 03
Copy the result.
What percent-encoding does
URLs are only allowed to contain a limited set of characters, so anything outside that set, spaces, accented letters, and reserved symbols like & ? / =, has to be escaped. Percent-encoding replaces each such byte with a percent sign and its two-digit hexadecimal value, so a space becomes %20 and an ampersand becomes %26.
This tool encodes text and URLs to percent-encoded form and decodes them back. It is built on the browser's standard encodeURIComponent and encodeURI functions, so the output matches exactly what your own JavaScript would produce, and it is UTF-8 safe for international text.
Encoding and decoding run entirely in your browser, so nothing you paste is sent to a server, which is reassuring when a URL contains tokens or query parameters you would rather not share.
Component mode vs full URL
The scope toggle matters. Component mode (encodeURIComponent) escapes reserved characters like & = ? / and is what you want for a single query-string value or path segment. Full-URL mode (encodeURI) leaves the structural characters intact so a complete URL stays usable.
Common mistakes to avoid
A common mistake is encoding an entire URL with component mode, which escapes the :// and ? and breaks the link. Another is double-encoding, where an already-encoded string is encoded again and %20 turns into %2520. When in doubt, decode first to see the raw value.
The plus-sign quirk in query strings
There is also a historical quirk in query strings: form submissions encode a space as a plus sign, while percent-encoding uses %20. Both are seen in the wild, so decoders generally accept either.
Frequently asked questions
Component vs full URL?
Component (encodeURIComponent) escapes reserved characters like & = ? / for a single query value or path segment. Full URL (encodeURI) preserves the URL structure so a whole link stays valid.
Why did decoding fail?
Malformed percent-sequences, such as a lone % or an incomplete %2, cannot be decoded. Check the input or re-encode it first.
What is percent-encoding?
It is the mechanism URLs use to represent characters that are not allowed directly: each byte is written as a percent sign followed by two hexadecimal digits, based on its UTF-8 value.
When should I use component mode?
Whenever you are inserting a value into a URL, such as a search term in a query string or a name in a path. It escapes the separators that would otherwise change the URL's meaning.
Why do I sometimes see + instead of %20 for spaces?
Form submissions (application/x-www-form-urlencoded) encode spaces as +, while standard percent-encoding uses %20. Decoders usually accept both.
Is my input uploaded?
No. Encoding and decoding happen in your browser, so the text and URLs you paste never leave your device.
Sources
Learn more
URL Encoding Explained: When and Why to Percent-Encode
Why URLs use %20 and other percent codes, which characters are safe, and when to reach for encodeURIComponent instead of encodeURI.
Base64 Explained: Why Encoding Is Not Encryption
What Base64 actually does, why it makes data about a third larger, when to use it, and why it protects nothing on its own.
How to Read a JWT, and Why Decoding Is Not Verifying
A JWT is three Base64url parts anyone can read. Learn how to decode one, what each part means, and why decoding proves nothing.
Hashing vs Encryption: What a Hash Can and Cannot Do
Hashing is one-way and keyless; encryption is two-way and needs a key. Learn the difference, why you cannot decrypt a hash, and when to use each.
How Webhook Signatures Work: HMAC, Shared Secrets, and Timing-Safe Checks
How Stripe and GitHub prove a webhook is genuine using HMAC and a shared secret, and the timing-safe comparison most developers get wrong.
How Passwords Should Be Stored: Salting, bcrypt, and Why Not SHA-256
Why a fast hash like SHA-256 is wrong for passwords, what a salt does, and why bcrypt, scrypt, and Argon2 are the right tools.