URL Encoder / Decoder
Percent-encode text for use in a URL, or decode an encoded URL back to readable text.
Percent-encoding (RFC 3986), UTF-8 · By Stuart Mathieson · Updated October 2026
Query parameters
| Name | Value (decoded) |
|---|
Everything runs in your browser - nothing you enter is sent to a server.
How URL encoding works
URLs can only contain a limited set of characters, and some characters have special jobs: ? starts the query string, & separates parameters, # starts a fragment. Percent-encoding (also called URL encoding) lets any text travel safely inside a URL. Each byte that isn't allowed is written as % followed by two hexadecimal digits:
| Character | Encoded | Why |
|---|---|---|
| space | %20 | Spaces aren't allowed in URLs |
& | %26 | Would start a new parameter |
? | %3F | Would start the query string |
/ | %2F | Would start a new path segment |
é | %C3%A9 | Two bytes in UTF-8 |
Letters, digits and - . _ ~ never need encoding - RFC 3986 calls them unreserved characters. Accented letters, other scripts and emoji are first converted to UTF-8 bytes, so one character can become several %XX groups.
Which mode to use
- A value or query parameter (
encodeURIComponent) encodes everything except unreserved characters and! ' ( ) *. Use it for anything you put inside a URL: a search term, a parameter value, a path segment.café & crème?becomescaf%C3%A9%20%26%20cr%C3%A8me%3F. - A whole URL (
encodeURI) leaves the characters that give a URL its structure -: / ? # & = @and others - so a full address still works. It only fixes spaces and other characters that aren't allowed. Because it leaves&and=alone, it can't protect a value that contains them.
Decoding and common problems
- Plus signs: HTML forms send spaces as
+(theapplication/x-www-form-urlencodedformat). Tick Treat + as a space when decoding form data or query strings; untick it when a+really means a plus. - Double encoding: if you see
%2520, the text was encoded twice -%25is an encoded%. Decode it twice to get back to the original. - Malformed input: a
%that isn't followed by two hex digits, or bytes that aren't valid UTF-8, can't be decoded - the tool tells you rather than guessing. - Not encryption: URL encoding hides nothing - anyone can decode it. The same goes for Base64.
Paste a full URL in either mode and the tool also lists its query parameters, decoded - handy for reading long tracking or redirect links.
Frequently asked questions
What is the difference between encodeURI and encodeURIComponent?
encodeURI is for a complete URL and leaves characters like : / ? & = # alone so the URL still works. encodeURIComponent is for one part of a URL, such as a parameter value, and encodes those characters too.
Why is a space sometimes %20 and sometimes +?
In URLs a space is %20. HTML form submissions use an older format where a space becomes +. Both decode to a space in a query string, but only %20 is correct in a URL path.
What does %2520 mean?
The text was encoded twice. %25 is an encoded percent sign, so %2520 decodes to %20, which decodes again to a space.
Is URL encoding a form of encryption?
No. It only makes text safe to put in a URL, and anyone can decode it. Never rely on it to hide information.
Sources
- RFC 3986: Uniform Resource Identifier (URI): Generic Syntax - IETF, 2005
- encodeURIComponent() - MDN Web Docs
- encodeURI() - MDN Web Docs