URL Encoder & Decoder at a glance
- What it does
- Percent-encode text for safe use in URLs or decode an encoded link back to readable form. Handles UTF-8 correctly and
- Where it runs
- Entirely in your browser — no data is uploaded
- Works offline
- Yes, once the page has loaded
- Cost
- Free, with no account and no usage limit
- Category
- Developer & Code
How to use the URL encoder
- Paste the text or URL you want to convert.
- Encode to escape unsafe characters, or Decode to turn
%20-style sequences back into readable text. - Copy the result into your query string, redirect parameter or bug report.
Which characters need encoding
Unreserved characters pass through untouched: A-Z a-z 0-9 - _ . ~. Everything else is either reserved - it has a structural job in a URL - or simply not permitted.
| Character | Encoded | Why it matters |
|---|---|---|
| space | %20 | Illegal in a URL. Some form encoders use + instead, which is only valid in a query string. |
& | %26 | Separates parameters. Unencoded inside a value it splits the parameter in two. |
= | %3D | Separates a key from its value. |
? | %3F | Starts the query string. |
# | %23 | Starts the fragment. Everything after it is never sent to the server. |
/ | %2F | Path separator. Must be encoded inside a value such as a redirect target. |
+ | %2B | Reads as a space in form-encoded data, so a literal plus must be escaped. |
é | %C3%A9 | Non-ASCII is encoded as its UTF-8 bytes - two bytes here, hence two escapes. |
encodeURIComponent vs encodeURI
JavaScript offers two functions and choosing the wrong one causes a large share of URL bugs.
encodeURIComponent() escapes everything that is not unreserved, including / ? : @ & = +. Use it for a single value you are inserting into a URL - a search term, a redirect target, a filename.
encodeURI() leaves the structural characters alone because it assumes you handed it a whole URL that is already assembled. Use it only to clean up a complete URL that contains spaces or accents.
Rule of thumb: if you are building the URL, encode each value with encodeURIComponent and join them yourself.
Double encoding, and how to spot it
If a value is encoded twice, % itself gets escaped to %25 and a space becomes %2520. Users see literal %20 in page titles and filenames download with odd names. Any %25 in a URL that should contain plain text is the tell - decode once and check whether the result still looks encoded.
The reverse problem is under-encoding: a redirect parameter carrying an unescaped & silently loses everything after it, because the server reads the rest as separate parameters.
Where URL encoding goes wrong in practice
Three failure modes account for most real bugs, and each has a recognisable symptom.
The redirect parameter that loses its query string. A login flow passes ?next=/search?q=shoes&page=2. Unencoded, the server reads page=2 as a parameter of the outer URL, and the user lands on /search?q=shoes with the page number silently dropped. The fix is to encode the entire value with encodeURIComponent before appending it.
The filename that arrives mangled. A download link to a file called Q3 report (final).pdf needs its spaces and parentheses escaped. Left raw, some browsers cope and some truncate at the space, producing a 404 that only reproduces for certain users.
The signature that stops matching. Payment gateways and webhook providers sign a canonical string built from your parameters. If your client encodes a space as + and their server expects %20, the signature fails and the response is an unhelpful "invalid request". Always check the provider's documented canonicalisation rules rather than assuming.
Reading an encoded URL
Decoding a URL is often the fastest way to understand what a system is doing. Analytics links, OAuth flows and single sign-on redirects all pack a great deal of structure into escaped parameters.
A typical OAuth authorisation URL contains an encoded redirect_uri, a scope with escaped spaces, and a state value that is often itself Base64. Decoding it shows exactly which permissions are being requested and where the user will be returned to — useful when debugging an integration, and worth doing before clicking a suspicious link.
Decoding a link before following it is a genuinely useful safety habit. Phishing URLs frequently hide the real destination inside an encoded redirect parameter on a domain that looks legitimate.
Frequently asked questions
Both appear. HTML form submissions use application/x-www-form-urlencoded, which encodes a space as +. Percent-encoding proper uses %20. %20 is safe everywhere in a URL; + only means space inside a query string, and is a literal plus in a path.
No - encoding a complete URL escapes its slashes and colons and breaks it. Encode the individual values you are inserting, then assemble the URL around them.
They are converted to UTF-8 bytes first, then each byte is percent-encoded. A single emoji typically becomes four escape sequences.
No. The conversion uses the browser's own encodeURIComponent and decodeURIComponent locally, so URLs containing session tokens stay private.
Nothing you enter here leaves your browser
URL Encoder & Decoder does its work in JavaScript running on your own device. The page loads once, and after that there is no upload step and no server involved — which matters here because API responses, tokens and configuration files are exactly the kind of thing that should not be posted to someone else’s server for formatting.
You can verify this rather than taking our word for it: load the page, disconnect from the internet, and the tool keeps working. Our privacy policy sets out what is and is not collected, and this guide explains why the distinction matters.