URL encoder / decoder
Percent-encode or decode text for URLs. In your browser
How to use the URL encoder / decoder
- Paste your text and pick Encode or Decode — the output updates live as you type, no button needed.
- Leave Whole URL unchecked for component mode: it percent-encodes everything that isn't safe inside a single value, including / ? & = # — right for one query-string parameter.
- Check Whole URL to encode a complete address: the structural characters : / ? & = # stay intact so the URL keeps working, while spaces and non-ASCII characters get escaped.
- Decoding follows the same switch — component mode unescapes everything, whole-URL mode leaves the structure alone.
- If decoding fails with “invalid percent-encoding”, the input has a stray % not followed by two hex digits — often a sign it was already decoded, or truncated mid-escape.
Common uses
- Put arbitrary text into a query parameter safely: a search phrase with & in it, a redirect URL inside a URL, or a filename with spaces.
- Decode a long tracking or redirect link (the ?url=https%3A%2F%2F… kind) to see where it actually points before clicking.
- Fix a broken link someone pasted into chat or a wiki, where spaces or Unicode characters weren't escaped.
- Make an international link portable — a path like /menü/café becomes pure ASCII (/men%C3%BC/caf%C3%A9) that survives systems which choke on non-ASCII bytes.
- Debug an API call: encode a parameter value exactly the way encodeURIComponent would in your own JavaScript, and compare against what your client sends.
Tips & limitations
- The two modes differ on exactly the URL-structure characters. Encoding a&b=c as a component gives a%26b%3Dc; in whole-URL mode it passes through unchanged — so encode values as components and full addresses as whole URLs.
- Non-ASCII text is escaped as its UTF-8 bytes: é becomes %C3%A9 and an emoji takes four %XX escapes. That's the modern standard servers expect.
- A + is not decoded to a space here. The plus-for-space rule belongs to HTML form encoding; standard percent-encoding writes a space as %20. If a pasted query string shows + between words, swap those to spaces yourself.
- Component mode leaves ! ~ * ' ( ) unescaped — JavaScript's definition of “safe”. A few strict APIs want those escaped too; if one complains, escape them manually.
- Encoding twice is a classic bug: %20 turns into %2520. If a decoded result still contains %XX sequences, it was double-encoded — run decode again.
How it's built & why it's safe
This tool is a thin, faithful wrapper around the browser's own functions: encodeURIComponent / decodeURIComponent in component mode and encodeURI / decodeURI in whole-URL mode — the exact implementations your JavaScript code calls, so results always match what you'd get in production. Conversion happens live on every keystroke, entirely on your device: URLs often carry session tokens, email addresses and internal hostnames, and none of that leaves the page.
Related tools: Base64 Encoder / Decoder · JSON Formatter · QR Code
Frequently asked questions
What is percent-encoding, and why do URLs need it?
URLs only allow a limited ASCII set, and characters like ?, & and = have structural meaning. Percent-encoding replaces everything else with %XX escapes of its UTF-8 bytes so the data travels intact — a space becomes %20, an ampersand inside a value becomes %26.
When do I use component mode versus whole URL?
Encode one piece of data destined for a query string or path segment as a component, so structural characters inside it get escaped. Use whole-URL mode only on a complete address you want to keep clickable — it preserves : / ? & = while escaping spaces and non-ASCII.
Why isn't + turned into a space when I decode?
Because + means space only in HTML form encoding (application/x-www-form-urlencoded), not in URLs generally. This tool implements standard percent-encoding, where a space is %20 and a + is a literal plus — the same behavior as JavaScript's decodeURIComponent.
Why do I get a decoding error?
The input contains a % that isn't followed by two hexadecimal digits, which makes the escape sequence invalid. That usually means the text was cut off mid-escape, hand-edited, or was never percent-encoded to begin with.
Why does my URL turn into %25 sequences like %2520?
It was encoded twice: the % of an existing %20 got escaped into %25. Decode repeatedly until no %XX sequences remain, and in your own code make sure only one layer — usually the final URL assembly — does the encoding.
Is anything I paste sent to a server?
No — encoding and decoding run entirely in your browser using its built-in functions. That matters with URLs, which routinely embed tokens, IDs and email addresses you wouldn't want logged elsewhere.