URL Encoder & Decoder

How to use the URL encoder

1. Choose ➡️ Encode or ⬅️ Decode. Results update as you type, and the 🔁 button sends a result back into the input so you can chain conversions.
2. When encoding, pick the encoder: encodeURIComponent for a single value, encodeURI for a whole address.
3. Turn on “+” as a space if you are working with form-encoded data, and Batch mode to convert a whole list, one URL per line.
4. Use the 🧩 Query builder tab to paste a URL and edit its parameters as a table — change values, add rows, delete rows, and the URL is rebuilt underneath.
5. Use the 🔍 URL parts tab to split any address into protocol, host, port, path, query and fragment, with warnings about anything suspicious.

How percent encoding works

A URL may only contain a small set of ASCII characters. Everything else is written as a percent sign followed by two hexadecimal digits, one escape per byte. Because the modern rule is to encode UTF-8, a character outside ASCII becomes several escapes.

RFC 3986 calls A–Z a–z 0–9 - . _ ~ the unreserved set: these never need escaping. The reserved set — : / ? # [ ] @ ! $ & ' ( ) * + , ; = — has structural meaning, so whether it must be escaped depends on where it appears. That is the whole difference between the two encoder modes.

Worked examples

A search query. The text hello world & more inside a query value becomes hello%20world%20%26%20more, or hello+world+%26+more with form encoding. Without escaping the ampersand, the server would read more as a second parameter.

A URL used as a parameter. To put https://example.com/a?b=1 inside ?next=, component mode gives https%3A%2F%2Fexample.com%2Fa%3Fb%3D1. Use URI mode here by mistake and the colons, slashes and question mark survive — the server then sees your redirect target as part of its own query string.

Spotting double encoding. search?q=hello%2520world looks odd because %25 is a percent sign. Decoding once gives hello%20world; decoding twice gives hello world. If your logs are full of %2520, some layer in the chain is encoding an already-encoded value.

Breaking down a URL. https://user@example.com:8443/docs/a%20b?tab=1#top splits into protocol https, user user, host example.com, port 8443, path /docs/a%20b, query tab=1 and fragment top. The tool flags the embedded username, because credentials in a URL end up in server logs and browser history.

Tips and common mistakes

• The fragment never reaches the server. Everything after # stays in the browser. Do not put anything there that a backend needs.
• Encode values, not whole query strings. Encode each key and each value separately, then join them with = and &. Encoding the assembled string escapes the separators too.
• A plus in a path is a plus. /a+b is a literal plus; only in a query or form body does it mean a space.
• Do not encode twice. If a library already escapes for you, escaping again produces %2520. Encode at exactly one layer.
• Case in escapes does not matter, but uppercase is the norm. %ed and %ED are the same byte; RFC 3986 recommends uppercase.
• Watch the tilde. encodeURIComponent leaves ~ alone, but some older server libraries escape it as %7E. Both are correct and they are not string-equal — normalise before comparing signatures.

Glossary

• Percent encoding – representing a byte as % plus two hex digits; also called URL encoding.
• Unreserved characters – the set that never needs escaping: letters, digits, -, ., _ and ~.
• Form encoding – application/x-www-form-urlencoded, the variant where a space is written as +.
• Punycode – the ASCII representation of an internationalised domain name, for example xn--h28h.
• Fragment – the part after #, used by the browser and never sent to the server.

Privacy

Encoding, decoding, query parsing and URL splitting all happen inside your browser tab in plain JavaScript. Nothing you type is sent anywhere, written to storage or logged — there is no server-side component that could receive it. This matters more for URLs than for most data: query strings routinely carry session identifiers, password-reset tokens, signed download links and personal details, and pasting one into a tool that round-trips through a server would hand all of that over. Here, closing the tab is the end of it.

Last reviewed: September 21, 2026