URL Encoder Decoder guide
Make any text safe to drop into a URL, or turn a wall of %3D and %26 back into something readable. Same functions your JavaScript uses, so the output matches your code.
What percent-encoding actually does
A URL can only safely carry a small set of ASCII characters. Everything else, and every character that has a job in URL syntax, has to be escaped. The escape is a percent sign followed by two hexadecimal digits, one pair per byte. A space is byte 0x20, so it becomes %20. An ampersand is 0x26, so it becomes %26.
RFC 3986, the URL standard, defines the unreserved characters that never need encoding: A to Z, a to z, 0 to 9, and four symbols: hyphen, underscore, period, and tilde (- _ . ~). Reserved characters such as : / ? # [ ] @ ! $ & ' ( ) * + , ; = have structural meaning, so they must be encoded when they appear inside a value.
Non-ASCII text is first converted to UTF-8 bytes, then each byte is encoded. That is why é becomes %C3%A9 (two bytes) and most emoji become four %XX groups.
How this tool encodes and decodes
Encode runs JavaScript's encodeURIComponent. It escapes everything except A-Z, a-z, 0-9, and - _ . ! ~ * ' ( ). Those last four are technically reserved in RFC 3986 but left alone for historical reasons; almost no server cares.
Decode runs decodeURIComponent, the exact reverse. If the input contains a % that is not followed by two hex digits, or a byte sequence that is not valid UTF-8, the tool shows an error instead of guessing. "100%" on its own fails for that reason; the encoded form is 100%25.
Encoding is safe to run on text that is already plain, but not on text that is already encoded. Encode is not idempotent: run it twice and every % turns into %25. Keep track of which state your string is in, and encode each value exactly once, right before it goes into the URL.
Worked example: a search query
You want to send the search term café & crème to https://example.com/search?q=. Paste the term into Encode and you get caf%C3%A9%20%26%20cr%C3%A8me. The final link is https://example.com/search?q=caf%C3%A9%20%26%20cr%C3%A8me.
Skip the encoding and the server sees q=café and then a second, empty parameter named " crème", because the raw & splits the query. That is the bug percent-encoding prevents.
Another one: a+b c encodes to a%2Bb%20c. The plus is escaped so no server mistakes it for a space.
encodeURI vs encodeURIComponent
JavaScript ships two encoders, and picking the wrong one is a classic bug. encodeURI is for a complete URL. It leaves : / ? & = # alone so the URL still works, and only escapes spaces, non-ASCII, and a few unsafe characters. encodeURI("https://example.com/a b?q=1&x=2") returns https://example.com/a%20b?q=1&x=2.
encodeURIComponent is for one piece of a URL: a query value, a path segment, a fragment. It escapes the structural characters too. Run the same full URL through it and you get https%3A%2F%2Fexample.com%2Fa%20b%3Fq%3D1%26x%3D2, which is useless as a link but exactly right when that URL is itself the value of a redirect or returnTo parameter.
Rule of thumb: build the URL from parts and run encodeURIComponent on each value. This tool does the component version because that is what you need 90 percent of the time.
The plus sign trap
HTML forms submitted with GET use application/x-www-form-urlencoded, an older format where a space is written as + instead of %20. PHP's urlencode, Python's quote_plus, and the browser's URLSearchParams all follow it. decodeURIComponent does not: it treats + as a literal plus.
So if you decode a+b%20c here, you get a+b c, not a b c. If your text came from a form or a URLSearchParams string, replace every + with %20 before decoding. Going the other direction, if a server is reading your %20 as literal text, it probably expects form encoding.
Double-encoding is the other common mess. If you see %2520 in a URL, something encoded an already-encoded %20 (the % became %25). Decode once and check again.
How we calculate: sources
Frequently asked questions
What is URL encoding?
URL encoding, or percent-encoding, replaces characters that are not allowed or have special meaning in a URL with a % followed by two hex digits per byte. A space becomes %20, & becomes %26, and é becomes %C3%A9 (its two UTF-8 bytes).
What does %20 mean in a URL?
%20 is an encoded space. 20 is the hexadecimal code for the space character (32 in decimal). Paste the text into Decode to turn every %XX sequence back into characters.
What is the difference between encodeURI and encodeURIComponent?
encodeURI encodes a whole URL and leaves structural characters like : / ? & = # alone. encodeURIComponent encodes those too, so it is the right choice for a single query value or path segment. This tool uses encodeURIComponent.
Why is + not decoded as a space?
In HTML form encoding (application/x-www-form-urlencoded), + means space. In standard percent-encoding it is a literal plus sign. This tool uses decodeURIComponent, which keeps + as +. Tick Form encoding if your text came from a form submission or a query string built by URLSearchParams; it decodes + as a space and encodes spaces as +.
Why do I get a malformed URI error when decoding?
The text has a % that is not followed by two valid hex digits, like "100%" or "%E9" on its own (an incomplete UTF-8 sequence). Encode stray % signs as %25, or decode only the part that was actually encoded.
Should I encode the full URL or just the parameter?
Just the parameter value, almost always. Encoding a full URL with encodeURIComponent turns https:// into https%3A%2F%2F, which is only what you want when the whole URL is itself a value inside another URL, like a redirect parameter.
Is my data private?
Everything runs in your browser. Nothing you enter is uploaded to a server or stored by us.
Is URL encoding the same as encryption?
No. Percent-encoding is a reversible formatting step with no key. Anyone can decode it instantly, so never rely on it to hide data.
What is %2F in a URL?
An encoded forward slash (/). It appears when a value containing a slash, like a file path or a date written 9/25, is placed inside a query parameter.