URL Encoder / Decoder

About this tool

The URL Encoder/Decoder handles percent-encoding for URLs. Supports both encodeURIComponent (for query parameters) and encodeURI (for full URLs). Decode percent-encoded strings back to readable text.

What percent-encoding is

URL encoding, formally called percent-encoding, is defined in RFC 3986. A URL may only contain a limited set of ASCII characters, so any byte outside that set is written as a percent sign followed by its two-digit hexadecimal value. A space becomes %20, an ampersand becomes %26, and a hash becomes %23. Non-ASCII text is first turned into its UTF-8 bytes, then each byte is percent-encoded, so the euro sign becomes %E2%82%AC.

Reserved vs unreserved characters

RFC 3986 sorts characters into two groups that decide what must be encoded. Unreserved characters are always safe and should never be encoded. Reserved characters carry structural meaning (they separate the parts of a URL), so they must be encoded when they appear inside a value rather than as a delimiter.

encodeURIComponent vs encodeURI

JavaScript ships two encoders, and choosing the wrong one is the most common URL bug. encodeURIComponent escapes every reserved character, so it is correct for a single piece such as a query value or a path segment. encodeURI deliberately leaves the URL delimiters alone so you can hand it a whole address, which means it will not protect a value that itself contains an & or a ?.

Neither function touches the unreserved set, and both encode space as %20. The encodeURIComponent button above matches the second column; the encodeURI button matches the first.

Form data and the + for space

There is a second, older scheme. When a browser submits an HTML form with the default application/x-www-form-urlencoded type, a space becomes a plus sign (+) rather than %20. The two are not interchangeable everywhere: in the path or in a true percent-encoded value a + is a literal plus, while in a form-encoded query string a + means space. A server that uses the wrong parser turns "a + b" into "a b" or "a b". When in doubt, encode space as %20, which is valid in both query and path.

Worked example: a search URL

Suppose you want a search link for the phrase café & bar. Encode only the value, not the whole URL:

The é is UTF-8 bytes C3 A9, the space is %20, and the & becomes %26 so the server does not read it as the start of a second parameter. If you had passed the entire string through encodeURI, the & would have survived unescaped and silently split your query. Paste the value into the tool above with the encodeURIComponent mode selected to reproduce this.

Edge cases and common pitfalls

• Double-encoding: running an already-encoded string through the encoder again turns every % into %25, so %20 becomes %2520 and the link breaks. Decode once to check before re-encoding.
• Encoding the whole URL: passing a full address to encodeURIComponent escapes the :// and the slashes, producing a single broken token. Encode the values, then assemble the URL.
• The reserved set is not universal: encodeURIComponent leaves ! ' ( ) * unescaped, though some strict servers want them encoded. Encode those manually if a target rejects them.
• + ambiguity: decodeURIComponent does not turn + back into a space. If the data came from a form, replace + with a space before decoding.

Percent-encoded values often start life as binary. Convert that binary to a safe string with the Base64 encoder and decoder first, inspect a token's claims with the JWT decoder, then tidy any returned object using the JSON formatter and validator.

Related Tools

Frequently asked questions