URL Encoder Decoder
Percent-encode or decode URLs and query strings, with component, full-URL, strict RFC 3986 and form (+ for space) modes.
Tool guide
What this tool does
URL Encoder Decoder converts characters that are not allowed in URLs into percent-encoded UTF-8 bytes such as %20 and %C3%A9, and decodes them back. It offers the same behaviour as encodeURIComponent and encodeURI, a strict RFC 3986 mode, HTML form encoding, and a breakdown of decoded URLs into host, path and query parameters.
URLs may only contain a limited set of ASCII characters. Spaces, accented letters, emoji and reserved symbols such as “&”, “=” and “#” must be percent-encoded, or a link breaks, a query parameter is cut short, or a server reads the wrong value. Each unsafe character is converted to its UTF-8 bytes, and each byte is written as “%” followed by two hexadecimal digits, so “é” becomes %C3%A9.
This tool gives you each encoding flavour explicitly. Component mode matches JavaScript’s encodeURIComponent and is right for a single parameter value. Full-URL mode matches encodeURI and leaves “:/?&=#” intact. Strict RFC 3986 also escapes !'()*, and form mode uses “+” for spaces as HTML forms do (application/x-www-form-urlencoded). When decoding a complete URL you also get a table of its protocol, host, path and every query parameter. Everything runs locally.
How to use URL Encoder Decoder
- Paste a URL, query string or plain text into the Input box. Several lines can be processed at once.
- Choose a Mode: an encode option, or Decode.
- When decoding form data or query strings, keep “Decode + as space” switched on.
- Turn on “Decode double-encoded input” if you see sequences such as %2520, which is an encoded %20.
- Read the result, check the URL breakdown table, then copy or download it.
Tips for better results
- Encode each parameter value separately, not the whole URL, so “&” and “=” inside values cannot split your query string.
- Both %20 and + represent a space in query strings, but only %20 is valid in the path part of a URL.
- Hex digit case does not matter: %c3%a9 and %C3%A9 decode identically. RFC 3986 recommends uppercase.
- For OAuth 1.0 signatures and AWS Signature V4, use the strict RFC 3986 mode.
Common use cases
- Building a search link whose query contains spaces and non-English words.
- Reading a long tracking URL with UTM parameters copied from an email.
- Debugging a redirect parameter that has been encoded twice.
- Preparing values for a curl command or an API request.
Common mistakes to avoid
- Using encodeURI on a parameter value: it leaves “&” and “=” untouched, which corrupts the query string.
- Encoding a URL that is already encoded, producing %25 sequences that servers then misread.
- Decoding “+” as a literal plus in a path, or as a space when the API expects a real plus sign.
Frequently asked questions
What is the difference between encodeURI and encodeURIComponent?
encodeURI is meant for a complete URL and keeps reserved characters such as : / ? & = # unchanged. encodeURIComponent is meant for one piece, such as a parameter value, and escapes those characters too.
Why does “é” become %C3%A9 rather than %E9?
Modern URLs use UTF-8, where “é” is the two bytes C3 A9. %E9 is the older Latin-1 form, which most current servers will not interpret as “é”.
What does the error “Malformed escape” mean?
A “%” in the input is not followed by two hexadecimal digits, for example “100%” in plain text. Encode such text first, or fix the broken sequence.
Which characters are never encoded?
The unreserved characters A–Z, a–z, 0–9 and - _ . ~ are always left as they are, in every mode except “Encode every byte”.
Feedback & suggestions
Help us improve URL Encoder Decoder. We read every message.