URL Encoder and Decoder

Type or paste text in the left box and the percent-encoded result appears on the right as you type. Choose Encode or Decode at the top, pick what to encode, and press Copy. ⇄ Swap moves the result back into the input and flips the mode, which is the quickest way to check that a value survives a round trip.

Most of the time you only need to url encode one value, such as a search term, a name or a redirect address, before you put it into a link. Keep the default Component mode for that. The other modes cover whole addresses, HTML forms, strict RFC 3986 output, every character, or only the characters that would break a link.

When you paste a full link, the page also breaks it into protocol, host, port, path and fragment, and lists each query parameter decoded. Below the main boxes are a Query string ⇄ JSON converter and a table of common codes. Everything runs in your browser, and nothing you type is sent anywhere.

A URL can only contain a small set of characters, and some of them have a job. The ? starts the query, & separates parameters, = joins a name to its value, # starts the fragment and / separates path segments. If a value you want to send contains one of these, or a space, an accented letter or an emoji, it has to be written in a safe form first.

That safe form is percent-encoding, defined in RFC 3986. Each byte of a character is written as a % sign followed by two hexadecimal digits. A space is byte 32, hex 20, so it becomes %20. An ampersand is %26, and the % sign itself becomes %25 so it is not mistaken for the start of an escape. Characters outside plain ASCII are first turned into bytes with UTF-8, and each byte gets its own %XX.

RFC 3986 sorts characters into groups. Unreserved characters, the letters A to Z and a to z, the digits 0 to 9 and - . _ ~, never need encoding. Reserved characters have a special meaning in some part of a URL, so they must be encoded when they are part of the data rather than the structure. Everything else, including spaces, quotes, < > and all non-ASCII text, is always encoded.

A tool to url encode online should not need a button, an account or a server, and this one does not. The result fills in while you type, the Copy button puts it on the clipboard, and a small counter shows how the length changes, for example 12 → 18 characters, which helps when a field or a link has a length limit.

Pasted something that already contains %XX codes while in Encode mode? A hint says This already looks URL-encoded, with a link to decode it instead. Encoding it again would turn every % into %25, a common cause of broken links.

Tick Each line separately to process many values at once. Every line is encoded or decoded on its own and the line breaks stay as they are, so a column of names or links pasted from a spreadsheet comes back as a clean column you can paste back.

Component is the default and the one to use for a single piece of a URL: one query value, one path segment, or a whole URL that you pass as a parameter inside another URL. It works like JavaScript's encodeURIComponent, so & = ? / # are all encoded.

Full URL is for a complete address that you want to make safe without changing its structure. Like encodeURI, it keeps : / ? & = # and the other reserved characters, and encodes spaces and non-ASCII letters. Unlike encodeURI, it leaves existing %XX sequences alone, so a link that is already partly encoded is not encoded twice.

Form follows application/x-www-form-urlencoded, the format browsers use when they submit a form: spaces become + and everything except letters, digits and - . _ ~ is encoded. RFC 3986 is the strict version of the same rule with %20 for spaces, the format many API signing schemes, such as OAuth 1.0, expect.

Here is how each mode handles the same short sample, a b&c/é!, with UTF-8:

Switch the mode to Decode to url decode online. Every %XX sequence is turned back into its byte, and the bytes are read as UTF-8 text, so %C3%A9 becomes é and %F0%9F%98%80 becomes 😀.

Treat + as a space is on by default, because form data and most query strings use + for spaces. Turn it off when you decode a path or a value where a plus sign is a real plus, such as a phone number like +44 or a Base64 string.

Broken sequences do not stop the decoder. A lone % or one followed by non-hex characters, as in 100% or %ZZ, is left exactly as it is, and a note counts how many broken or non-UTF-8 sequences were found. If accented letters come out as odd symbols, the text was probably encoded with ISO-8859-1; switch the character set and decode again.

When text has been encoded more than once, the page tells you how many layers it found, for example Encoded 2 times (double encoding), with a Decode all layers button. You can also tick Decode repeatedly, which keeps decoding, up to five times, until no %XX codes are left. The layer count is shown when you decode the text as one block, not with Each line separately.

There are two ways to write a space, and both are correct in the right place. In the path of a URL, a space must be %20. In a query string sent by an HTML form, the format application/x-www-form-urlencoded uses + for a space, and most servers also accept %20 there.

So when you url encode space characters, the safest choice is %20: it means a space everywhere. A + only means a space in query strings and form bodies; in a path, /a+b really is a plus sign. Choose Form when a system specifically wants plus signs, and any other mode for %20.

The reverse problem is common too. A real plus sign in a value, such as C++ or an international phone number, must be sent as %2B. If it is sent as a bare +, the server reads it as a space. Every mode here except Full URL encodes a plus sign as %2B.

All characters mode encodes everything, even letters and digits, so hello becomes %68%65%6C%6C%6F. A browser decodes it to the same text, because %68 and h mean the same thing in a URL.

Why url encode all characters? It is useful for tests, to check that a server decodes every escape correctly, for teaching how bytes map to hex, and when a system requires a fully escaped value. It is not a way to hide anything: anyone can decode it in a second, so it is not encryption or security.

Output grows quickly. Each ASCII character becomes three characters, and each non-ASCII character becomes six to twelve. Watch the length counter under the result if a field has a limit.

Only special encodes the minimum: spaces, control characters, non-ASCII letters and the characters that break or change a URL, which are % & = ? # + " < > \ ^ ` { | }. Letters, digits and other punctuation such as / : @ ! stay as they are.

Use it when you want to url encode only special characters and keep the result readable, for example a file path with spaces like /docs/My Report.pdf, which becomes /docs/My%20Report.pdf, or a title with accents in a link you will read later. It suits logs, documentation and links people will look at.

Because it keeps / and :, it is not the right mode for a value that will sit inside another URL, such as a redirect parameter. Use Component for that, so the inner address cannot be confused with the outer one.

JavaScript has two built-in functions, and mixing them up is a classic bug. encodeURIComponent encodes everything except letters, digits and - _ . ! ~ * ' ( ). Use it for any single value: a query parameter, a path segment or a URL you put inside another URL. It matches the Component mode.

encodeURI keeps the characters that give a URL its structure, ; , / ? : @ & = + $ #, and encodes the rest. Use it only for a whole address that may contain spaces or non-ASCII letters. If you use it on a value, an & or = inside that value stays raw and splits your query string in the wrong place. The Full URL mode is similar, but it also leaves existing %XX codes untouched.

To decode, use decodeURIComponent, which turns every %XX back into text but leaves + as it is. It throws a URIError on a broken sequence such as a lone %, which is why this page decodes tolerantly instead. For form data, replace + with a space first, or use URLSearchParams, which reads + as a space and builds query strings with + for spaces, like the Form mode here.

Every language can url encode string values, but the defaults differ, and that is where most mismatches come from. The main question is always the same: does the function write a space as %20 or as +, and which punctuation does it leave alone?

In Python, urllib.parse.quote keeps / by default, because it was written for paths; pass safe='' to encode / as well, for a query value. urllib.parse.urlencode turns a whole dict into a query string, with + for spaces. In PHP, rawurlencode follows RFC 3986 with %20, while urlencode uses + like a form.

In Java, URLEncoder is a form encoder, despite its name: it writes spaces as + and also encodes ~. Since Java 10 you can pass StandardCharsets.UTF_8 directly; on older versions, pass "UTF-8". In C#, Uri.EscapeDataString gives RFC 3986 output with %20, and WebUtility.UrlEncode gives + for spaces.

To compare your code with this page, use RFC 3986 mode for rawurlencode, quote(s, safe='') and Uri.EscapeDataString, Component for encodeURIComponent, and Form for quote_plus. PHP urlencode, Java URLEncoder and WebUtility.UrlEncode also match Form, apart from small differences in characters such as ~ and *.

Percent-encoding works on bytes, not letters, so a character first has to be turned into bytes. Today that means UTF-8, the encoding modern web standards require. Plain ASCII letters take one byte. Accented Latin letters and Greek, Cyrillic, Arabic and Hebrew letters take two. Chinese, Japanese and Hindi take three, and emoji take four.

That is why one character can turn into a long code: é becomes %C3%A9 and 😀 becomes %F0%9F%98%80. Decoding reverses it, and the decoder must use the same character set. If é was encoded as UTF-8 and decoded as Latin-1, you get é, the typical sign of a mix-up.

Some older systems still use ISO-8859-1 (Latin-1), where é is the single byte %E9. Choose ISO-8859-1 (Latin-1) under Character set to encode or decode that way. Latin-1 only covers 256 characters, so characters outside it, such as € or emoji, cannot be represented; this page writes them as %FF. Stay on UTF-8 unless you know the receiving system needs Latin-1.

Double encoding happens when text that is already encoded is encoded again. The % of %20 becomes %25, so the space ends up as %2520. Decode it once and you get %20, not a space. On a web page this shows up as a literal %20 or %2520 in a file name, a search box or an email subject.

It usually comes from two layers of code each doing their job: a form encodes a value, then a library encodes the whole link again, or a redirect URL is encoded once by your code and once by the framework. Fix it by encoding exactly once, at the moment you build the URL, and decoding exactly once when you read it.

Sometimes several layers are correct. A link inside the redirect parameter of another link, which itself sits inside a third link, needs one layer per level. In that case decode one layer at a time with Decode repeatedly turned off, and check each step.

This page helps from both sides. In Encode mode, a hint warns when the input already looks encoded. In Decode mode, the layer count shows how many times the text was encoded, and Decode all layers removes them in one go.

Paste a full link, starting with https:// or another scheme, or with www., and a URL parts card appears under the boxes. In Decode mode it uses the decoded result. It shows the protocol, the host, the port, or (default) when none is given, the path with each segment decoded, and the fragment after #.

Below that, every query parameter is listed with its name and its decoded value, in the order they appear, repeated names included. This makes the page a handy url decoder for long tracking links, redirect chains and API calls: you can see at a glance what utm_source, a redirect_uri or a search term really says.

Copy parameters as JSON copies the same parameters as a JSON object. A name that appears more than once, such as tag=a&tag=b, becomes an array, so nothing is lost.

The Query string ⇄ JSON card converts in both directions. Paste a query string such as q=hello%20world&page=2&tag=a&tag=b, or a whole link with a ? in it, and press Convert. You get a JSON object with each value decoded: {"q": "hello world", "page": "2", "tag": ["a", "b"]}. Repeated names become arrays and the fragment after # is ignored.

Values are always strings in this direction, because a query string has no types; 2 comes back as "2". That is how a server sees the data too, so a url decode to json step is a quick way to check what an API call actually sends.

Paste a JSON object instead, starting with {, and Convert builds the query string. Arrays become repeated names, null becomes an empty value, nested objects are written as JSON text, and spaces become +, as in a form. If the JSON is not valid, the card says Not valid JSON.

Everything on this page runs in your browser. The text, links and query strings you paste are not uploaded, not logged and not added to the address bar. That matters, because real links often contain session tokens, email addresses, API keys or private search terms.

The page remembers only your settings, such as the mode, the encoding mode, the character set and the decode options, in this browser's local storage. The text itself is never saved. You can clear the stored settings in your browser's site data settings.

Remember that percent-encoding is not encryption. Anyone who sees an encoded link can decode it, so never rely on it to hide a password or a token.

Percent-encoding is one of several text encodings you meet on the web. For binary data inside text, such as an image or a token, use the Base64 tool. A JWT from a login link can be read with the JWT Decoder, and a Unix time in a query parameter with the Timestamp Converter.

Got JSON from the query string converter? The JSON Formatter makes it readable, and JSON to CSV turns a list of records into a spreadsheet. To compare a link before and after a change, paste both into the Diff Checker. Once a link is ready to share on paper or a screen, the QR Code Generator turns it into a code a phone can scan.