URL Encode & Decode

How to use the URL encoder and decoder

1. Choose Encode or Decode.
2. Pick a mode: component for a single query value or path segment, or full URL to keep the URL's structure (:, /, ?, &) intact.
3. Paste your text or URL and copy the result.

Everything is processed in your browser. URLs often carry tokens and personal data in query strings, and none of it is uploaded or stored.

What is percent-encoding?

URLs may only contain a limited set of ASCII characters. Percent-encoding, defined in RFC 3986, represents any other byte as a percent sign followed by two hexadecimal digits. Text is first converted to UTF-8 bytes, then each byte that needs escaping is written as %XX:

café & crème   →   caf%C3%A9%20%26%20cr%C3%A8me

Here é is two UTF-8 bytes (C3 A9), the space becomes %20 and the ampersand becomes %26.

Reserved and unreserved characters

Reserved characters must be encoded when they appear as data rather than as delimiters. A search for R&D has to be sent as q=R%26D; otherwise the server sees a second parameter called D.

encodeURIComponent vs encodeURI

JavaScript offers two functions, and choosing the wrong one is a frequent source of bugs:

• encodeURIComponent() encodes everything except A–Z a–z 0–9 - _ . ! ~ * ' ( ). Use it for individual values: query parameters, path segments, fragment data.
• encodeURI() additionally leaves ; , / ? : @ & = + $ # untouched, so it can be applied to a complete URL without breaking its structure. It will not protect a value that contains & or #.

encodeURI("https://example.com/a b?q=R&D")
// "https://example.com/a%20b?q=R&D"      (& left alone)

"https://example.com/search?q=" + encodeURIComponent("R&D")
// "https://example.com/search?q=R%26D"

Better still, let URLSearchParams or your language's URL library build query strings for you.

Common pitfalls

+ versus %20

HTML forms submitted as application/x-www-form-urlencoded encode a space as +. In RFC 3986 URLs, + is a literal plus sign and a space is %20. A decoder that does not know which convention was used may turn C++ into C or leave + in place of spaces. Encode a real plus sign as %2B to be safe.

Python:  urllib.parse.quote("a b&c")       → a%20b%26c
         urllib.parse.quote_plus("a b&c")  → a+b%26c

Double encoding

Encoding an already encoded string escapes the percent signs themselves: %20 becomes %2520. This usually happens when a value is encoded by your code and again by a framework or HTTP client. If you see %25 in a URL, suspect double encoding. Decoding twice is just as harmful: it can turn a literal %41 in user data into A.

Encoding the whole URL as a component

Running encodeURIComponent on a full URL escapes :// and every /, producing https%3A%2F%2F.... That is correct only when the URL is itself a parameter value, such as a redirect_uri.

Tips

• Hexadecimal digits in percent-encodings are case-insensitive, but RFC 3986 recommends uppercase (%2F, not %2f).
• Internationalised domain names are not percent-encoded; they use Punycode (xn--) instead.
• Need to transport binary data in a URL? URL-safe Base64 is more compact than percent-encoding every byte.
• Inspect how a server handles your encoded request with the HTTP headers checker.

Frequently asked questions

Why is a space sometimes + and sometimes %20?

+ comes from the HTML form encoding used in query strings and POST bodies; %20 is the general RFC 3986 encoding that is valid everywhere in a URL. When in doubt, use %20.

Which characters never need encoding?

The unreserved set: letters, digits, hyphen, period, underscore and tilde. Everything else should be encoded when it is part of a value.

Is URL encoding a security measure?

No. It only makes data syntactically safe inside a URL and is fully reversible. It does not hide data or prevent injection on its own.

How do I decode a URL with %uXXXX sequences?

%uXXXX is a non-standard format produced by the deprecated JavaScript escape() function. Standard decoders reject it; it has to be converted separately.