Open menu

URL Encode & Decode

Encode text so it can be placed safely in a URL, decode percent-encoded strings back to readable text, or split a complete URL into scheme, host, path, fragment and decoded query parameters. Choose between encoding a single parameter value, a whole URL, or form data where spaces become plus signs. Malformed escapes are located precisely, and tracking parameters such as utm_source are flagged, with a clean link ready to copy.

Mode
Encode as

Encodes every reserved character (encodeURIComponent, plus ! ' ( ) *). Use it for a single query value or path segment.

Input

40 characters

Output

Encoded
Caf%C3%A9%20%26%20B%C3%A4ckerei%3A%2050%25%20off%20%E2%80%94%20%E2%80%9Ctoday%20only%E2%80%9D%3F

Runs entirely in your browser. Nothing you paste or open here is uploaded or stored.

How to use the URL encoder

  1. Choose a mode: Encode, Decode or Parse a URL.
  2. For encoding, pick Parameter value, Whole URL or Form data. The help text under the options explains each.
  3. Paste your text and copy the result.
  4. To inspect a link, choose Parse, paste the full URL, and read the parts and parameters in the tables.

How percent-encoding works

URLs may only contain a limited set of ASCII characters. Everything else, and every character that has a special meaning in the current position, is written as % followed by two hex digits for each byte. Text is first converted to UTF-8, so é becomes the two bytes C3 A9 and is written %C3%A9. An emoji takes four bytes and twelve characters.

The three modes differ in what they leave alone:

  • Parameter value keeps only A–Z a–z 0–9 - _ . ~ and encodes everything else. This tool also encodes ! ' ( ) *, which RFC 3986 reserves.
  • Whole URL additionally keeps : / ? # [ ] @ & = + $ , so the URL’s structure survives.
  • Form data is like a parameter value, but writes spaces as +.

Worked examples

You want to link to a search for Café & Bäckerei: 50% off. Encoded as a parameter value, it becomes Caf%C3%A9%20%26%20B%C3%A4ckerei%3A%2050%25%20off. Without encoding, the & would start a new parameter and the % would be read as the start of an escape.

Example 2: a redirect parameter

Login pages often take a return address: /login?next=https://example.com/a?b=1. The inner URL must be encoded as a value (https%3A%2F%2Fexample.com%2Fa%3Fb%3D1); otherwise its ?b=1 is treated as part of the outer URL.

Parse the sample shop URL. The table shows the decoded search term zapatos rojos, the size and two utm_ parameters. The cleaned URL below the tables keeps the search and size but drops the tracking.

Decoding tips

If decoding fails, the error gives the character position of the first broken %. That often means the text was cut off mid-escape or was never encoded. Double-encoded text (%2520 for a space) decodes to %20; decode again to get the space.

Common mistakes

  • Encoding a whole URL as a value. You get https%3A%2F%2F…, which is correct only inside another URL.
  • Encoding twice. Frameworks often encode for you; adding your own creates %25 sequences.
  • Using + for spaces in paths. + means space only in query strings from forms; in paths it’s a literal plus.
  • Forgetting the fragment. Everything after # never reaches the server.

Frequently asked questions

When should I use “parameter value” versus “whole URL”?

Use parameter value (encodeURIComponent) for anything you insert into a URL: a search term, a redirect target, a path segment. It encodes &, =, ? and / so they can't break the URL's structure. Use whole URL (encodeURI) only to clean up a complete address that contains spaces or accented letters.

Why do spaces sometimes become + and sometimes %20?

HTML forms submit data as application/x-www-form-urlencoded, where spaces are written as +. Elsewhere in URLs a space is %20. Choose “form data” to encode like a form, and turn on “treat + as a space” when decoding form data.

What does a malformed escape error mean?

Every % in an encoded URL must be followed by two hexadecimal digits, like %20 or %C3. A lone % or something like %zz can't be decoded, so the tool shows its position instead of guessing.

Are tracking parameters safe to remove?

Parameters like utm_source, gclid and fbclid only tell analytics where a click came from; they don't change the page. Removing them gives cleaner, more private links to share.

Which characters are safe in a URL without encoding?

Letters, digits and - _ . ~ are always safe. Reserved characters like ? & = / # have special meaning and must be encoded when they're part of a value.

Sources