URL Encoder / Decoder
Percent-encode text for safe use in URLs and query strings, or decode it back to readable form.
A URL may only contain a narrow set of characters. Spaces, ampersands, question marks and unicode letters all have to be translated into percent-encoded sequences before a browser, a web server or an API will treat them literally. This encoder converts text into that safe form and back, so you can build query strings that behave and decode links that other systems produced.
The encode direction turns each unsafe character into a percent sign followed by two hex digits - a space becomes %20, an ampersand becomes %26. The decode direction reverses the process and restores the original text. Because the conversion happens per character, whole paths, payloads and message bodies can be encoded in one pass.
Encoding is handled entirely in your browser. Any string you paste stays on your machine, which is useful when the value contains sensitive data that you do not want relayed through a third-party service. The result is copied with a single click and is yours to use in a request, a header or a test case.
Features
- Encode text for use in URLs, and decode percent-encoded strings back to plain text.
- Handles spaces, ampersands, slashes, unicode and every reserved character.
- Validates input and reports a clear error for malformed sequences like a lone percent sign.
- Instant conversion with no round trip to a server.
- Output suitable for query parameters, form data and fetch bodies.
- Fully offline and private - nothing is stored or transmitted.
How to Use
- 1
Enter the string
Paste a plain-text value, a full URL, or an already-encoded string that you want to read.
- 2
Select the direction
Choose Encode to escape a value for a URL, or Decode to unescape an encoded string back to readable text.
- 3
Process the value
Press the button and review the result. Encoded output keeps every character valid for URL syntax.
- 4
Copy or download
Copy the result into your request, header or test case, or use the download option for longer values.
Example
Text to percent-encoding
What is 2 + 3?↓
What%20is%202%20%2B%203%3FEncoded value to text
https%3A%2F%2Fexample.com%2Fpath%3Fq%3Dhi%20there↓
https://example.com/path?q=hi thereCommon Problems
Encoding an entire URL instead of just its parts
Running encodeURIComponent over a whole URL turns the colons and slashes into %3A and %2F, which breaks the structure. Encode each query value and path segment separately, then assemble the URL.
Forgetting that "+" means a space
In query strings, a literal plus is interpreted as a space. If your data contains plus signs, they must be percent-encoded as %2B, otherwise the receiving server reads a different value.
Double-encoding a value
Encoding an already-encoded string escapes the percent signs themselves, so %20 becomes %2520. Each round trip adds a layer. Encode once at the point of construction and decode once at the point of use.
Decoding malformed sequences
A percent sign not followed by two hex digits is invalid percent-encoding. The decoder rejects it with a clear message rather than guessing, so you can see that the source string is corrupt.
Assuming encoding is security
Percent-encoding does not sanitize or protect anything. It only makes text representable inside a URL. Injection defenses live elsewhere - encoding is a transport detail, not a boundary.
Encoding credentials into URLs
Putting a password or token directly into a URL string, encoded or not, leaks it into logs, browser history and referrer headers. Pass secrets in headers or bodies where supported, never in the visible URL.
Technical Details
Percent-encoding represents each unsafe byte as a percent sign followed by its two hex digits, so a single character can expand to multiple percent-sequences. It is reversible by construction: decoding replaces each sequence with its original byte.
This tool uses encodeURIComponent and decodeURIComponent semantics, which reserve more characters than the older escape() functions and are what modern libraries emit. That makes the output correct for query parameters and form data out of the box.
Characters that are legal in a URL - letters, digits, and a small set like - _ . ~ - pass through unchanged, keeping encoded values as compact as possible while remaining safe.
The conversion runs entirely in the browser using the platform's native encoders, so behaviour matches what your own JavaScript runtime would produce when building requests.
Because percent-encoding is a pure character transform, decoding is the exact inverse of encoding: run a string through both and you recover the original byte-for-byte. That round trip is what makes the pair safe to use around any parser, with no state or configuration involved.
Frequently Asked Questions
Why do spaces become %20 instead of staying spaces?
Because a literal space is not allowed in a URL. The percent form is how the browser and server agree to represent it. Some older systems accept "+" for spaces in query strings, but %20 is the universal form.
What is the difference between encodeURI and encodeURIComponent?
encodeURI keeps structural characters like "/" and ":" intact, so it suits whole URLs. encodeURIComponent escapes nearly everything, so it suits individual values. This tool follows the component rules, which is what you need for query values and segments.
Will decoding break a valid URL?
Decoding a correctly encoded string restores exactly what was encoded. It only becomes a problem if you decode a URL that was never percent-encoded and contains literal characters that look like sequences.
Does this tool send my URL anywhere?
No. Encoding and decoding happen locally in your browser. The string you paste is never uploaded, logged or otherwise transmitted.
Can I use this to encode emoji and unicode text?
Yes. UTF-8 characters such as emoji are encoded into their percent forms and can be decoded back to the original text, which is how modern URLs carry unicode content.
Do I need to encode the question mark and ampersand?
If they are part of the value, yes. A question mark inside a value must become %3F and an ampersand %26, otherwise the server splits the query at those characters and the value is truncated.
Why does the tool leave letters and digits untouched?
Unreserved characters are legal in a URL as-is, so encoding them would only bloat the output. The encoder skips letters, digits and the allowed punctuation, exactly matching browser behaviour.
Data & Privacy
Your data stays in your browser. Nothing is uploaded.
- Processing
- Local
- Upload
- None
- Server Storage
- None
- Account
- Not required
Related Tools
Base64 Encode & Decode
Convert text to Base64 or decode it back, with an optional URL-safe mode - all in your browser.
Encoding & Conversion
HTML Entity Encoder / Decoder
Convert HTML to its escaped entity form or decode entities back to readable markup.
Encoding & Conversion
Unicode Converter
Escape text as \uXXXX sequences or decode them back to readable characters, for JSON, JavaScript and Java.
Encoding & Conversion
Hex Converter
Convert text to hex bytes and back, revealing the UTF-8 representation of any string.
Encoding & Conversion
Binary Converter
Convert text to its 8-bit binary form and decode binary strings back to readable text.
Encoding & Conversion
URL Parser
Break any URL into protocol, host, path, query parameters and fragment for easy inspection.
Encoding & Conversion