Free URL Encoder & Decoder
Percent-encode URLs, query strings and path segments — or decode %20, %2F and + back to readable text. Full UTF-8 support, RFC 3986 strict mode, all in your browser.
Your Input
:// ? # & intact, switch to Full URL.Encoded Output
No output yet
Start typing in the left panel to see the resultWhat Is URL Encoding?
URL encoding — also called percent-encoding — is the process of replacing characters that are not allowed in a URL with a percent sign followed by two hexadecimal digits. Each %XX pair represents one byte of the character's UTF-8 encoding.
It exists because URLs are restricted to a small subset of ASCII. Characters outside that set — spaces, quotes, non-Latin scripts, emoji, and even some ASCII symbols that have structural meaning — must be escaped before they can safely travel through browsers, proxies, servers and log files.
The unreserved character set (RFC 3986)
These characters are safe to use literally in any part of a URL. Everything else must be percent-encoded unless it has a specific structural meaning in that position.
| Category | Characters |
|---|---|
| Uppercase | A – Z |
| Lowercase | a – z |
| Digits | 0 – 9 |
| Punctuation | - _ . ~ |
Common characters and their encoded forms
| Character | Encoded | Notes |
|---|---|---|
| Space | %20 | Or + in query strings and form bodies |
! | %21 | Strict mode only |
" | %22 | Always |
# | %23 | Fragment delimiter — always encode in a value |
$ | %24 | Sub-delimiter |
% | %25 | The escape character itself |
& | %26 | Parameter separator — always encode in a value |
' | %27 | Strict mode only |
( ) | %28 %29 | Strict mode only |
* | %2A | Strict mode only |
+ | %2B | Encode when it means a literal plus |
, | %2C | Sub-delimiter |
/ | %2F | Path separator — encode inside a value |
: | %3A | Scheme separator — encode inside a value |
; | %3B | Sub-delimiter |
= | %3D | Key/value separator — encode inside a value |
? | %3F | Query delimiter — encode inside a value |
@ | %40 | Authority separator |
é | %C3%A9 | Two UTF-8 bytes |
| 🚀 | %F0%9F%9A%80 | Four UTF-8 bytes |
Component vs Full URL — which do I need?
JavaScript provides two functions that behave very differently, and picking the wrong one is the single most common source of broken URLs:
| Scope | Function | What it encodes | Use it for |
|---|---|---|---|
| Component | encodeURIComponent() | Everything except A–Z a–z 0–9 - _ . ! ~ * ' ( ) | Query-string values, path segments, form fields |
| Full URL | encodeURI() | Everything unsafe, but preserves : / ? # [ ] @ & = + $ , ; | Complete URLs you don't want to break apart |
For example, if you want to pass https://example.com/a b as a value of a query parameter url=, you must use Component mode. The result https%3A%2F%2Fexample.com%2Fa%20b survives round-trip parsing. If you use Full URL mode, the ? and & inside the value are left intact and would be misinterpreted by the receiving server as new parameters.
The %20 vs + debate
There are two ways to represent a space in a URL, and they are not interchangeable:
%20is the RFC 3986 standard. It works in the path, query string, fragment and HTTP headers. This is what every modern encoder produces.+is a legacy from HTML form encoding (application/x-www-form-urlencoded). It means space only inside a query string or form body. In a URL path, a literal+means plus.
When decoding, this tool offers a toggle: enable Treat + as space if you are decoding a value from a form submission or query string, or leave it off if you're decoding a path segment where + should remain a plus.
Double-encoding and %25
If a value gets encoded twice by mistake, % becomes %25, so a space can end up as %2520. To decode it you have to run the decoder twice: %2520 → %20 → space. A string full of %25 is almost always a sign of accidental double-encoding somewhere in your pipeline.
Common use cases
Build Query Strings
Encode user input safely before adding it as ?q=….
Encode API Tokens
Bearer tokens and signatures often contain +, / and =.
International URLs
Convert non-ASCII paths and domains to their percent-encoded form.
Handle Filenames
Encode spaces and special characters before linking to a file.
Social Share URLs
Put a URL into a query parameter without breaking it.
Debug Redirect Loops
Decode the redirect_uri and return_to values to see where they point.
Read Server Logs
Turn /search?q=hello%20world back into readable text.
Inspect Suspicious Links
Decode obfuscated URLs before clicking them.
Privacy and security
This URL encoder and decoder runs entirely in your browser. Encoding uses the browser's native encodeURIComponent and encodeURI functions, decoding uses decodeURIComponent and decodeURI. Nothing is uploaded, stored or transmitted. Safe for API keys, signed URLs, OAuth tokens and internal endpoints.
Frequently Asked Questions
What is URL encoding?
%20, an ampersand becomes %26, and an emoji becomes a four-byte sequence like %F0%9F%9A%80.Is this URL encoder free?
Is my data sent to a server?
encodeURIComponent, decodeURIComponent, encodeURI and decodeURI functions. Your URLs, tokens and query strings never leave your device.What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent encodes almost everything, including the reserved characters : / ? # [ ] @ & = + $ , that give a URL its structure. It is the correct choice for individual query-string values, path segments or form fields. encodeURI leaves those structural characters alone, so it is used when you have a complete URL and want to preserve its structure while encoding only the parts that are truly unsafe, such as spaces and non-ASCII characters.Why does a space become %20 in some URLs and + in others?
%20 is the RFC 3986 standard and works everywhere — in the path, query string, fragment and headers. The + sign is a legacy from HTML form encoding (application/x-www-form-urlencoded) and means space only inside a query string or form body. In a URL path, a literal + means plus, not space, so %20 is always the safer choice.What are reserved characters in a URL?
: / ? # [ ] @ ! $ & ' ( ) * + , ; =. They only need encoding when they appear as data — for example, an ampersand inside a query value must be encoded as %26 or the server will treat it as a parameter separator. The tool's Component mode encodes all of them; Full URL mode preserves the ones that structure the URL.Why does my URL contain %25?
%25 is an encoded percent sign. If your URL contains the literal character % that is not part of a percent-escape, it must itself be encoded as %25, otherwise decoders will try to read the next two characters as a hex code. Double-encoded values often look like %2520, which decodes once to %20 and again to a space.Should I encode a whole URL or just parts of it?
:// ? # & = characters stay intact and the URL remains parseable by browsers and servers.Can I decode a URL that was double-encoded?
%2520, which decodes once to %20 and a second time to a space.What is RFC 3986 strict mode?
A–Z, a–z, 0–9, hyphen, underscore, period and tilde. It also lists ! ' ( ) * as sub-delimiters that some strict servers expect to be encoded. JavaScript's built-in encodeURIComponent leaves those five characters unencoded, so strict mode additionally escapes them to %21 %27 %28 %29 %2A for maximum compatibility.Which characters are safe to leave unencoded in a URL?
A–Z, a–z, 0–9, hyphen (-), underscore (_), period (.) and tilde (~). Everything else must be percent-encoded unless it has a structural purpose in that specific position. Modern browsers also accept many other characters, but not every server, proxy or logging system will — encoding is always the safe choice.