URL Encoder & Decoder
Percent-encode and decode URLs and query strings, with explicit component, full-URL and form modes. Runs entirely in your browser.
Input
0 charsEncoded
Type or paste text to encode.
Encoding and decoding happen in your browser. URLs, tokens and query parameters are never transmitted or logged.
About the URL Encoder & Decoder
Percent-encode text for a URL, decode an escaped one back to readable characters, and see a URL split into its scheme, host, path and query parameters. Everything runs in your browser, so tokens and signed URLs stay on your machine.
"URL encoding" is really three different encodings, and picking the wrong one is the most common URL bug there is. encodeURIComponent escapes the delimiters — `/ ? & = # :` — so it is correct for a value going inside a query parameter. encodeURI leaves those delimiters alone so a whole URL stays usable. Form encoding is encodeURIComponent plus a space written as `+`, which is what HTML forms and URLSearchParams produce. This tool makes the choice explicit rather than guessing.
The difference is not cosmetic. Encoding a search term with encodeURI leaves any `&` in it untouched, so the server reads the rest of the value as a new parameter and your query silently truncates. The same applies to `+`: it means a space in a form body and a literal plus everywhere else, which is why decoding also asks which mode you are in.
- Three explicit modes: component, full URL, and form (`+` for space)
- Decode errors report the exact malformed escape and its position
- Double-encoded values detected, with a one-click Swap to peel each layer
- Query strings shown as a decoded key/value table, repeated keys included
- Full Unicode support, including emoji and other characters outside the BMP
How to use it
- Choose Encode or Decode.
- Pick the mode: Component for a single value, Full URL for an entire address, Form for an HTML form or URLSearchParams body.
- Paste your text into the left pane — the result updates as you type.
- If the input parses as a URL, check the parts table below to confirm each query parameter decoded to what you expected.
- Use Swap to feed the result back into the input, which is how you unpick a double-encoded value one layer at a time.
Real-world use cases
Backend & API developers
Encode a query parameter value correctly before building a URL by hand, or decode one pulled from a request log to read what was actually sent.
Frontend developers
Decode a redirect or OAuth callback URL to inspect the parameters a third party passed back, instead of squinting at a raw percent-encoded query string.
QA & test engineers
Decode a URL captured from a bug report or a HAR file to see the real path and parameters behind the encoding, and confirm a fix actually changed what's sent.
Security & AppSec engineers
Peel back layered or double encoding in a suspicious URL or parameter during triage, using the double-encoding detector and Swap to unwind one layer at a time.
Integration engineers
Work out which of the three encodings an external API actually expects by comparing Component, Full URL and Form output for the same value side by side.
Examples
Encoding a query value
price > 100 & in stock
price%20%3E%20100%20%26%20in%20stock
Component mode. The `&` becomes %26, which is what stops the server reading "in stock" as a separate parameter.
The same text in form mode
price > 100 & in stock
price+%3E+100+%26+in+stock
Spaces become `+`. This is what a browser sends for an HTML form and what URLSearchParams produces.
Encoding a whole URL
https://example.com/search?q=café & crème
https://example.com/search?q=caf%C3%A9%20&%20cr%C3%A8me
Full URL mode keeps `://`, `?` and `&` intact so the address still works — which is exactly why it is the wrong mode for a single value.
Non-ASCII characters
日本 😀
%E6%97%A5%E6%9C%AC%20%F0%9F%98%80
Each character is encoded as its UTF-8 bytes: three each for the Japanese characters, four for the emoji.
Common errors
| Message | Cause | Fix |
|---|---|---|
| URIError: URI malformed | A `%` that is not followed by two hex digits, or a multi-byte sequence that was cut short — often from truncating an already-encoded string. | Decode here instead; the error names the exact escape and its position. A stray literal `%` must be written as %25. |
| Query parameter is truncated at an & | The value was encoded with encodeURI (or not at all), so its `&` was left intact and the server started a new parameter. | Encode the value in Component mode, then place it into the URL. |
| Spaces arrive as + signs | The value was form-encoded but the receiver decoded it with decodeURIComponent, which does not treat `+` as a space. | Decode in Form mode, or send %20 by using Component mode on the way out. |
| A literal + in the data becomes a space | The mirror image of the above — a value containing a real plus (a base64 string, a phone number) was decoded as form data. | Use Component mode when decoding, and encode a literal plus as %2B when sending. |
| Value still shows %2520 after decoding | Double encoding. %25 is an encoded `%`, so the original `%20` was encoded a second time — usually by two layers each helpfully encoding the same value. | Decode twice. The tool flags this case and Swap feeds the result straight back in. |
| Signature or HMAC check fails on a signed URL | The URL was re-encoded after it was signed, changing the exact bytes the signature covers. | Sign and transmit the same encoding. Do not normalise or re-encode a signed URL in transit. |
Frequently asked questions
›Is my URL sent to a server?
No. Encoding, decoding and URL parsing all run in your browser using the platform's own APIs. Signed URLs, access tokens and query parameters never leave the page, and nothing is stored or logged.
›What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent escapes the reserved delimiters — / ? & = # : @ — because a value must not be able to alter the structure of the URL it sits in. encodeURI leaves them alone so an entire URL survives encoding intact. Use Component for a single value, Full URL for a whole address.
›When is a space %20 and when is it +?
%20 is the general percent-encoding and is valid anywhere in a URL. `+` means a space only in application/x-www-form-urlencoded data — form bodies and, by convention, query strings. Anywhere else, `+` is a literal plus character.
›Which characters never need encoding?
The unreserved set: A–Z, a–z, 0–9, and the four marks - _ . ~ (RFC 3986). Everything else is either reserved with a structural meaning or outside the ASCII range, and should be percent-encoded when it appears in a value.
›How are emoji and non-Latin characters handled?
They are encoded as their UTF-8 bytes, one %XX per byte. A Japanese character takes three bytes, an emoji takes four because it is stored as a surrogate pair. Decoding reassembles them, and an incomplete sequence is reported rather than silently producing a replacement character.
›Why does my value show %2520?
It was encoded twice. The first pass turned a space into %20, and the second turned that % into %25, giving %2520. Decode twice to recover the original. The tool detects this and offers Swap to peel one layer at a time.
›Can I encode a full query string with several parameters in one go?
Not in Component mode — that mode escapes & and = along with everything else, which would break the parameter structure it's supposed to preserve. Encode each value on its own in Component mode, then assemble key=value pairs joined by & yourself. Full URL mode is the other direction: it leaves & and = alone precisely so an already-assembled URL keeps working, which makes it the wrong mode for encoding a single value.
›Why doesn't the URL parts table show up for my input?
It only appears when the text parses as a complete, absolute URL — scheme, host and all — using the browser's own URL constructor. A bare value, a path fragment, or a URL missing its https:// will encode or decode correctly but won't produce a parts table, because there's no scheme or host to extract from it.
Last updated