URL Encode/Decode
Max 256 KB · Processes automatically as you type
URL encoding — formally called percent-encoding — is how text that isn’t safe to put directly into a URL gets represented using only the characters a URL is allowed to contain. A URL has a small set of characters with structural meaning: / separates path segments, ? starts the query string, & separates parameters, = separates a parameter’s name from its value. Any of those characters appearing literally inside a value, rather than playing their structural role, would make the URL ambiguous or simply break it. Percent-encoding sidesteps the problem by rewriting a byte as % followed by two hexadecimal digits — %20 for a space, %26 for &, and so on — so the character survives as data without being mistaken for a delimiter.
The one detail that actually matters when encoding is captured by this tool’s two modes, and they’re not interchangeable. Component mode (JavaScript’s encodeURIComponent) escapes every character outside letters, digits, and a small unreserved set (-_.!~*'()) — including the structural characters themselves. That’s the correct choice whenever you’re encoding a single piece of data that’s going to be placed inside a URL, like a search term or a query parameter value, because it guarantees nothing in that value can be misread as a delimiter. Full URI mode (encodeURI) is deliberately less aggressive: it leaves ; / ? : @ & = + $ , # unescaped, because those characters are assumed to already be doing their structural job in a complete URL you’re encoding as a whole — encoding them anyway would corrupt the URL’s own structure rather than protect it.
Decoding reverses either mode with decodeURIComponent or decodeURI. Malformed input — a stray % not followed by two hex digits, or a percent-encoded byte sequence that isn’t valid UTF-8 — is caught explicitly and reported as an error rather than producing garbled or silently incomplete output.
Everything runs locally in the browser using JavaScript’s built-in encoding functions; nothing is sent to a server, and there’s no size limit beyond the 256 KB input cap that keeps re-encoding responsive on every keystroke.
Examples
- Encoding a search query for a URL — a value like "coffee & tea" typed into a search box needs Component mode before it's safe to append as ?q=coffee%20%26%20tea; encoding it in Full URI mode instead would leave the & unescaped and silently break the query string into two parameters.
- Decoding a redirect URL from a browser address bar or a log line — paste a URL you copied that's full of %20 and %3D sequences into Decode mode (Full URI) to read it as a human would, without hand-decoding each triplet.
- Passing a Base64 string through a URL — Base64's alphabet includes + and /, both of which have special meaning in a query string; encode the Base64 output from the Base64 Encode/Decode tool in Component mode before appending it to a URL, or run a JSON payload through the JSON Formatter tool first if what you're actually passing is structured data.
Frequently asked questions
What's the difference between Component and Full URI mode?
encodeURIComponent) escapes every character outside letters, digits, and -_.!~*'() — including & = / ? — which is correct when you're encoding a single value that will be placed inside a URL, such as a query parameter. Full URI mode (encodeURI) leaves those structural characters (; / ? : @ & = + $ , #) unescaped, which is correct when you're encoding an entire URL and want its slashes and query delimiters to keep working as delimiters rather than become literal data.Why does encoding a query value in Full URI mode produce a broken URL?
& or =. If the value you're encoding contains one of those characters and you paste the result directly into a query string, it will be read as a second parameter or an extra delimiter instead of part of the value. Use Component mode for anything that isn't already a complete URL.Why does Decode mode show an error?
% that isn't followed by two valid hexadecimal digits, or a percent-encoded byte sequence that isn't valid UTF-8 — for example, a truncated multi-byte character. Both are cases the browser's decoder refuses to guess at, so an error is shown instead of a silently wrong result.Does this handle emoji and non-Latin scripts correctly?
%XX triplet — the same encoding real browsers and servers produce and expect, so the result round-trips correctly through Decode mode.Is my data sent to a server?
encodeURIComponent/decodeURIComponent and encodeURI/decodeURI. No data leaves your device.