URL Encoder and Decoder

What percent-encoding is for

A URL may only carry a limited set of characters in each part. Everything else (spaces, accents, ampersands, slashes you meant as data, emoji) has to be written as a percent sign plus two hex digits of UTF-8. A space becomes %20. The ã in São becomes %C3%A3 because ã is the two UTF-8 bytes C3 A3. This page applies that rule in either direction.

Encode → turns your text into the safe form. Decode ← turns percent-escapes back into readable characters. Which characters get escaped depends on the Encoding menu: a single component, or a whole URL whose structural marks you want to leave alone.

Component versus whole URL

Those two modes are the browser functions encodeURIComponent and encodeURI (and their decode twins). They are easy to mix up and the bug is usually silent until a query string splits on the wrong ampersand.

• Component (the default) encodes anything that is not unreserved. That includes &, =, ?, /, and :. Use it for one path segment or one query value, then concatenate the result yourself.
• Whole URL leaves structural characters such as colon, slash, question mark, hash, ampersand, and equals intact so an already-built address stays clickable. It still encodes spaces and non-ASCII. Use it when the input is a complete link.

Worked example: a login redirect that loses half its query

A login page sends users back where they came from with ?next=. The page they came from is /search?q=café & bar&page=2. Paste that path into the field.

With Encoding set to Whole URL and Encode pressed, the result is /search?q=caf%C3%A9%20&%20bar&page=2. Built into the link, that gives:

https://example.com/login?next=/search?q=caf%C3%A9%20&%20bar&page=2

A server reading that query sees three parameters: next = /search?q=café , an empty parameter named bar, and page = 2. Whole-URL mode deliberately keeps &, ? and =, so they split the outer query.

Switch Encoding to Component and press Encode again:

https://example.com/login?next=%2Fsearch%3Fq%3Dcaf%C3%A9%20%26%20bar%26page%3D2

Now the server sees one parameter, next, with the full original path /search?q=café & bar&page=2. The rule: a value that goes inside another URL's query is a component, even when the value itself looks like a URL. Before redirecting, also check that next points to your own site, or the login page becomes an open redirect.

How to use this page

1. Choose Component or Whole URL in the Encoding menu. The choice applies to both Encode and Decode.
2. Paste into the left pane. The header tracks character count. Nothing converts until you click.
3. Click Encode → or Decode ←. Status reads Encoded or Decoded plus the mode name. Mode in the strip repeats that pair. Input and Output are character counts.
4. Copy result copies the right pane. Clear wipes both sides and returns status to Waiting for input.

A decode that contains a broken escape (a percent not followed by two hex digits) clears the output and sets Status to an invalid percent-encoding message. An empty input is treated as waiting, not as an empty result.

Short examples

A single value, component mode. Input hello world, Encoding set to Component, click Encode. Output: hello%20world. Input name=Ada Lovelace encodes to name%3DAda%20Lovelace because the equals sign is data, not a separator, when you asked for a component.

The same text, whole-URL mode. Input name=Ada Lovelace, Encoding set to Whole URL, click Encode. Output: name=Ada%20Lovelace. The equals sign stays. A complete address such as https://example.com/search?q=hello world becomes https://example.com/search?q=hello%20world: scheme, slashes, question mark, and equals stay; the space becomes %20.

Run that same full address through Component and every reserved mark is escaped, including the colons and slashes. That result is what you want when the whole address is itself one query value. It is not a link you can click.

Non-ASCII. Input São Paulo, either mode: S%C3%A3o%20Paulo. Input café: caf%C3%A9. Decode of S%C3%A3o%20Paulo in Component mode returns São Paulo.

Plus signs and other traps

Form bodies that use the application/x-www-form-urlencoded type often encode a space as +. This page does not. Decode of hello+world returns hello+world, plus sign included. If you have a plus that was meant as a space, replace plus with %20 first, or replace plus with a real space, then decode.

Decode uses the same mode you picked for encode. A string that was encoded as a component can contain %2F and %3F. Whole-URL decode leaves those as percent-escapes if they would break decodeURI. When in doubt, decode as Component.

Common mistakes

• Encoding a full link in Component mode, then pasting the result into a browser bar. The slashes become %2F and the address will not load.
• Encoding a query value in Whole URL mode. An ampersand inside the value stays raw and splits the query into extra keys.
• Encoding twice. %20 becomes %2520. Decode once to see if you are already encoded.
• Expecting this page to parse a query into a table of keys. It converts a string. It does not split on &.

What it will not do

It does not apply punycode to a hostname. It does not build or parse a query object. It does not encode a file. It does not replace plus with space. It will not fetch the address you typed.

Privacy

Encoding and decoding run in this tab. The text is not uploaded or stored. The page keeps working offline once it has loaded. Closing the tab clears both panes.