URL Encode & Decode
Percent-encode and decode URLs, query parameters and form data. Pick the escaping rule that matches where the text is going — the wrong one breaks URLs silently.
Leaves unescaped: {{ safeSet }} · {{ spaceNote }}
{{ inCount }}
{{ error }}
{{ warning }}
{{ outCount }}
All encoding and decoding happens in your browser. Your text is never uploaded to a server.
About URL encoding
URLs may only contain a limited set of ASCII characters. Percent-encoding replaces everything else
with a % followed by two hex digits representing a byte — so a space becomes
%20 and é, which is two bytes in UTF-8, becomes %C3%A9.
There is no single "URL encoding"
Which characters need escaping depends on where the text is going, and this is where most encoding bugs come from:
Component escapes everything that isn't unreserved, so it is right for a single
query-parameter value or one path segment. Full URL deliberately leaves
/ ? : @ & = # alone so a complete address keeps its structure. Form
data matches what a browser sends when submitting a form, where a space becomes
+.
Using Component mode on a whole URL turns https://x.com/a?b=c into
https%3A%2F%2Fx.com%2Fa%3Fb%3Dc — correct as a value, useless as a link. Using Full URL
mode on a parameter value leaves & and = intact, which lets that value
inject extra parameters into your query string.
Plus signs are the most common source of corruption
In form data a + means a space. In a path segment it means a literal plus. Decoding
with the wrong rule turns C++ into C followed by two spaces, with nothing
to warn you. This tool keeps the two apart, and decodes a%2Bb as a+b
rather than a b.
Double encoding
If a string is encoded twice, %20 becomes %2520. Decoding once gives you
%20 back rather than a space. When that happens the tool says so and offers to decode
again, instead of leaving you to notice the stray percent signs yourself.
Working with Base64 instead?
Use the Base64 encoder and decoder.
Frequently asked questions
Which mode should I use?
Component for a single query-parameter value or one path segment. Full URL when encoding a whole address, because it preserves the characters that give a URL its structure. Form data for application/x-www-form-urlencoded bodies, where a space becomes a plus sign rather than %20.
What is the difference between + and %20?
Both can mean a space. Form-data encoding uses +, while component and full-URL encoding use %20. In a path segment a plus sign is a literal plus, not a space, so decoding with the wrong rule turns C++ into C followed by two spaces.
Why does my text still contain % signs after decoding?
It was probably encoded twice. %2520 decodes to %20, which is still an escape sequence rather than a space. The tool warns you when this happens and you can decode again.
What does strict RFC 3986 mode do?
JavaScript's encodeURIComponent leaves ! ' ( ) and * unescaped, but RFC 3986 treats them as reserved sub-delimiters. Strict mode escapes them too, which some servers and request-signing schemes require.
Does this tool send my text anywhere?
No. Encoding and decoding run entirely in your browser. Nothing is transmitted to a server.