Skip to content
ToolBoxGeniehome

URL Encoder / Decoder

Developer Tools · By Sidhin · Added

Percent-encode text for safe use in a URL, or decode an encoded URL back into something readable. A component mode escapes everything reserved, a full-URI mode preserves the structural characters, and any query string can be split into a table of parameters.

Direction
Scope

Component mode escapes every reserved character — correct for a single value.

How to use the url encoder / decoder

  1. 1Choose Encode or Decode.
  2. 2Pick component mode for a single value, or full-URI mode for a whole address.
  3. 3Paste your text and read the result.
  4. 4Paste a full URL into the parser to see each query parameter separately.

Examples

Encoding a search term

Input
coffee & cake
Result
coffee%20%26%20cake

Parsing a query string

Input
https://example.com/s?q=tea+bags&page=2
Result
q = tea bags · page = 2

About the url encoder / decoder

Which characters actually need encoding

Unreserved characters — letters, digits, hyphen, full stop, underscore and tilde — are always safe. Reserved characters have structural meaning and must be escaped when they appear inside a value rather than as part of the URL's grammar. Everything else, including spaces and all non-ASCII text, has to be encoded.

Non-ASCII characters are encoded as their UTF-8 bytes, each written as a percent escape. This is why a single accented letter becomes two escape sequences and a CJK character becomes three.

Encode once, at the right layer

Build URLs with a proper API — URL and URLSearchParams in JavaScript, the equivalent in any other language — rather than by concatenating strings. Those APIs encode each part correctly and exactly once.

Manual string building is where double-encoding is born: a value gets escaped when it is stored, escaped again when the URL is assembled, and arrives at the server with a %2520 in it that nobody can explain.

Frequently asked questions

What is the difference between component and full-URI encoding?
Component encoding escapes every reserved character including / ? : @ & = + $ #, which is correct for a single value being slotted into a URL. Full-URI encoding leaves those alone so an already-assembled address stays functional. Using the wrong one either breaks the URL or fails to escape a value properly.
Is a plus sign a space?
In the query string of a form submission, yes — that is the application/x-www-form-urlencoded convention. In a path segment, no: there a plus is a literal plus and a space must be %20. This ambiguity is the source of a great many bugs.
Why do I sometimes see %2520?
That is a double encoding: %20 was encoded again, turning its percent sign into %25. It means a value passed through two encoding steps without a decode in between. Decode it twice here to confirm.

Related tools