URL Encoder and Decoder
A free online URL encoder and decoder. Percent-encode text or a full address, decode %XX sequences back to readable text, and see the query parameters a URL really carries. Everything is converted in your browser — nothing is uploaded.
Encode or decode
Paste text, a URL or a percent-encoded string. It converts as you type, and nothing is uploaded or stored.
Paste something above to convert it.
Nothing converted yet.
Your text is converted locally with JavaScript. It is never sent to a server, never logged and never saved.
URLs may only contain a small set of characters. Anything else — spaces, accents, emoji, or the characters that give a URL its structure, like & and ? — has to be written as % followed by the two hex digits of each UTF-8 byte. This tool does that conversion in both directions and shows you the URL it produces, piece by piece.
Key benefits
Common use cases
How to use it
- 1.Pick a direction. Choose Text → URL-encoded to encode, or URL-encoded → Text to decode.
- 2.Choose what you are encoding. Leave Encode a whole URL off for a single value such as one query parameter; turn it on for a complete address you want to keep working.
- 3.Paste your input. It converts as you type. If the input is a web address, the URL breakdown lists its host, path and every decoded query parameter.
- 4.Copy or round-trip. Copy the result, or press Swap to feed it back with the direction flipped and confirm you get the original back.
Percent-encoding, explained
The rules come from RFC 3986 and the HTML forms specification. Most bugs come from mixing up which rule applies where.
%20 is a space, %2F is a slash, %C3%A9 is the two UTF-8 bytes of é.- . _ ~ never need encoding. Encoding them is allowed but pointless, and a good encoder leaves them alone.: / ? # [ ] @ ! $ & ' ( ) * + , ; = structure the URL. Inside a value they must be encoded, or they change what the URL means.encodeURIComponent encodes every reserved character and is right for a value. encodeURI keeps them and is right for a whole address.%20 into %2520. If you see %25 followed by two hex digits, something encoded an already-encoded value.Key features
- Encodes and decodes, with a swap button for round trips
- Two modes: a single value (encodeURIComponent) or a whole URL (encodeURI)
- Optional + for spaces, matching HTML form encoding
- Breaks a URL into scheme, host, path, fragment and decoded query parameters
- Reports where a malformed % sequence is, instead of failing silently
- Warns when the input looks double-encoded
- Works offline once the page has loaded; no account, no upload
Encoding is not escaping for HTML or SQL
Percent-encoding makes a value safe to put inside a URL. It does not make it safe to put inside HTML, JavaScript or a database query — each of those has its own escaping rules. A value that was correctly URL-encoded can still carry an injection attack once a server decodes it.
So encode for the place the data is going: percent-encode for URLs, HTML-escape for pages, and use parameterised queries for SQL. If your data travels as Base64 inside a URL, use the URL-safe alphabet — our Base64 encoder and decoder does both.
Frequently asked questions
What is URL encoding?⌄
URL encoding, also called percent-encoding, writes characters that are not allowed in a URL as a % followed by two hexadecimal digits for each byte. A space becomes %20 and é becomes %C3%A9, its two UTF-8 bytes. It lets any text travel inside a URL without changing its meaning.
What is the difference between encodeURI and encodeURIComponent?⌄
encodeURIComponent encodes every character with a special meaning in a URL, including / ? & and =, so it is the right choice for one value such as a query parameter. encodeURI leaves those characters alone so a complete address keeps working. Using encodeURI on a value lets an & inside it split your parameter in two.
Should a space be %20 or +?⌄
Both are correct in different places. In the query string of an HTML form submission (application/x-www-form-urlencoded), a space is +. In a path, and in most APIs, a space is %20 and + means a literal plus sign. When in doubt, %20 is always safe.
Why do I see %2520 in my URL?⌄
%25 is the encoded form of the % sign itself, so %2520 is %20 encoded a second time. Something encoded a value that was already encoded. Decode it twice to get the original back, then fix the code so it encodes only once.
Is URL encoding a form of encryption?⌄
No. It is completely reversible and uses no key, so anyone can decode it. Never rely on it to hide a password, token or personal data in a URL; URLs end up in logs, browser history and Referer headers.