URL Encoder / Decoder
Convert URLs with special characters to percent-encoded format or decode them back. Runs in your browser.
Updated July 11, 2026
100% Private & Secure
This tool runs in your browser.
Your data is never uploaded or stored.
How to use
- 1
Enter your URL or encoded string.
- 2
Click Encode or Decode.
- 3
Copy the result.
When to use it
Passing query parameters with special characters
A search term like c++ & java contains + (space in form encoding), & (parameter separator), and spaces. Without encoding, the server reads it as three separate parameters. encodeURIComponent turns it into c%2B%20%26%20java.
Building redirect URLs that contain a URL
When one URL is a parameter inside another (?next=/dashboard?tab=2), the inner ? and = are ambiguous. Encoding the inner value makes the nesting explicit and parseable.
Embedding JSON or Base64 in a path segment
Path segments cannot contain / as data β it would be read as a folder boundary. Percent-encoding keeps the literal slash (%2F) so the router treats it as one segment.
Debugging a 400 from an API or a broken mailto: link
Servers reject unencoded spaces, brackets, and non-ASCII. Decoding the failing URL back to readable form is the fastest way to spot the offending character before re-encoding it correctly.
How it works
How percent-encoding works
Percent-encoding is defined in Section 2.1 of RFC 3986. Any byte can be written as a triplet: % followed by two uppercase hexadecimal digits. So a literal space becomes %20, a literal % becomes %25.
Characters split into three groups: unreserved (AβZ aβz 0β9 - . _ ~) never need encoding; reserved characters (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) have structural meaning and must be encoded when used as data; everything else (including all non-ASCII bytes) must be encoded.
- Unreserved set:
A-Z a-z 0-9 - . _ ~β safe everywhere, no encoding needed - Gen-delims:
: / ? # [ ] @β structural, encode when they are data - The
%sign itself must always be encoded as%25
encodeURIComponent vs encodeURI β pick the right one
JavaScript ships two encoders because they serve different scopes. encodeURIComponent escapes everything with structural meaning β use it for a single query value, where & or = would otherwise be misread as delimiters.
encodeURI leaves the structural characters (: / ? # & =) intact, because its job is to make a complete already-formed URL safe β not to encode one piece of it. Using the wrong one is the most common URL bug.
// Encode ONE value β escapes & = ? so they stay as data:
encodeURIComponent('a & b') // -> 'a%20%26%20b'
// Encode a WHOLE URL β keeps : / ? intact:
encodeURI('https://x.co/a b') // -> 'https://x.co/a%20b'The + vs %20 space trap, and the WHATWG shift
In application/x-www-form-urlencoded (the default form content type), a space is encoded as +. In a URL path or RFC 3986 context, a space is %20. Mixing these up is why hello+world sometimes decodes to "hello world" and sometimes stays literal.
For browsers, the authoritative spec is now the WHATWG URL Living Standard, which aligns RFC 3986 with what browsers actually do β including defined error handling the RFC never specified. For non-browser code, RFC 3986 remains the reference.
Common mistakes & edge cases
A query value with & or = is split into extra parameters
You used the value raw. Wrap it in encodeURIComponent so & and = are sent as data (%26, %3D), not as delimiters.
Spaces show up as + in one place and %20 in another
+ means space only in form-urlencoded bodies. In URL paths and RFC 3986 contexts, use %20. encodeURIComponent produces %20; form encoding produces +.
Double-encoding: %20 becomes %2520
The value was already encoded and got encoded again. Decode once before re-encoding, or skip encoding for values that are already percent-encoded.
Non-ASCII characters (Γ©, δΈζ, emoji) break the URL
These must be encoded as their UTF-8 byte sequence β Γ© becomes %C3%A9. encodeURIComponent handles this automatically; never hand-roll it.