URL Encoder & Decoder

How to use the URL encoder and decoder

1. Choose Encode to make text safe for a web address, or Decode to turn percent codes such as %20 back into readable text.
2. When encoding, say what you are encoding. A single value or parameter should have every special character encoded. A whole URL should keep its own punctuation, such as https:// and the ? and & that separate parts.
3. Copy the result. If the input contains a query string, the tool also lists each parameter decoded, so you can read a long tracking link at a glance.

All encoding follows the UTF-8 standard, so accented letters, Urdu, Arabic, Chinese and emoji produce the same codes as a browser would.

Why URLs need encoding

A URL can safely contain only a small set of characters: letters, digits and - _ . ~. Everything else either has a special job (/ separates path segments, ? starts the query, & separates parameters, # starts the fragment) or is not allowed at all, such as spaces and non-English letters. Percent-encoding replaces an unsafe character with a percent sign and the two-digit hexadecimal value of each of its UTF-8 bytes.

space → %20 é → %C3%A9 (two bytes) 😀 → %F0%9F%98%80 (four bytes)

If you put & inside a parameter value without encoding it, the server reads it as the start of a new parameter. The text "Tom & Jerry" in ?title=Tom & Jerry arrives as a title of "Tom " and a stray parameter named " Jerry". Encoded as title=Tom%20%26%20Jerry, it arrives intact.

Common characters and their codes

Component or full URL: which setting?

In JavaScript these two modes are encodeURIComponent() and encodeURI(). Using the full-URL mode on a single value leaves & and = alone, which breaks the parameter it sits in. Using the value mode on a whole URL turns https:// into https%3A%2F%2F, which no longer works as a link.

Worked example

The sample address is https://example.com/search?q=café & tea&lang=ur&name=اردو.

• As a complete URL, it becomes https://example.com/search?q=caf%C3%A9%20&%20tea&lang=ur&name=%D8%A7%D8%B1%D8%AF%D9%88. The structure is kept, and the é, the spaces and the Urdu word are encoded. The unencoded & inside the q value remains a problem, which is why a value like that should be encoded on its own before being put in the URL.
• As a value, "café & tea" becomes caf%C3%A9%20%26%20tea, which is safe to drop after q=.

Which characters never need encoding

JavaScript's encodeURIComponent leaves ! ' ( ) * alone for historical reasons. These are harmless in most places, but strict servers and some signing schemes, such as OAuth 1.0, require them to be encoded too, which is what the strict option does.

Common mistakes

• Encoding twice. If you see %2520 in a link, the % of %20 has been encoded again. Decode once and the problem is clear.
• Encoding the whole URL as a value. This turns the colon and slashes into codes, so the result is no longer a working link. Only do it when the URL is a parameter of another URL, such as a redirect.
• Forgetting to encode user input. A search term with an & or # in it will break the query if it is put straight into a link.
• Mixing up + and %20. A literal plus sign in a value must be written as %2B, or a server reading the query as form data will turn it into a space.

Accuracy and limits

Encoding and decoding use the browser's standard functions and are exact. The tool does not check whether a URL is reachable or valid, and it does not encode domain names with non-Latin letters (internationalised domain names use a different method called Punycode). Decoding fails with a clear message if a percent sign is not followed by two hexadecimal digits, or if the bytes do not form valid UTF-8 text.

Frequently asked questions