URL Encode / Decode

How to use the URL encoder and decoder

1. Pick Encode to make text safe for a URL, or Decode to turn percent-encoded text back into readable characters.
2. Type or paste into the top box. The result updates on every keystroke; there is nothing to submit.
3. In Encode mode, tick Encode a whole URL if you pasted a complete address rather than a single value, and Encode spaces as + if the result goes into a form-style query string.
4. In Decode mode, Decode + as a space is on by default. Turn it off when a plus sign in the text is a real plus.
5. Click Copy, or ⇅ Swap to move the result into the input and flip the mode – a quick way to check that a value survives a round trip.

Whenever the input is a full http:// or https:// address, a URL parts table appears with the protocol, host, decoded path, each query parameter on its own row and the fragment after #. It is the fastest way to read a long tracking link or an API request someone sent you.

What percent-encoding is

RFC 3986, the standard that defines URL syntax, lets only a small set of ASCII characters appear as they are. Letters, digits and - . _ ~ are “unreserved” and never need encoding. Characters such as : / ? # [ ] @ ! $ & ' ( ) * + , ; = are “reserved”: they separate the parts of a URL, so they must be encoded when they appear inside a value. Everything else – spaces, quotes, accented letters, Korean, Japanese or Chinese text, emoji – is always encoded.

Encoding works on bytes, not characters. The text is first converted to UTF-8, and each byte that needs escaping is written as % followed by two hexadecimal digits. That is why one character can turn into several escapes: é is two bytes (%C3%A9), most CJK characters are three (서 becomes %EC%84%9C), and an emoji such as 👍 is four (%F0%9F%91%8D).

The three options explained

• Default uses JavaScript’s encodeURIComponent. It escapes everything except letters, digits and - _ . ! ~ * ' ( ), so &, =, /, ? and + are all encoded. Use it for one piece of a URL: a search term, a parameter value, a file name inside a path.
• Encode a whole URL switches to encodeURI, which leaves the reserved characters alone so the address keeps its structure. Use it to clean up a link that contains spaces or non-ASCII characters.
• Encode spaces as + replaces every %20 with +, the convention of HTML form submissions (application/x-www-form-urlencoded). In the default mode a plus sign that was already in your text becomes %2B, so it can’t be mistaken for a space.

Worked examples

Whole-URL mode cannot repair an address whose values already contain reserved characters. Encoding https://example.com/search?q=rock & roll&page=2 that way gives q=rock%20&%20roll, and a server will read q as just “rock ”. The fix is to encode the value on its own in the default mode – rock%20%26%20roll – and then insert it into the URL.

Common mistakes

• Double encoding. Encoding text that is already encoded turns every % into %25, so %20 becomes %2520. If you see %25 followed by two hex digits in a link, something encoded it twice. Decode once and look again.
• Plus signs that should stay plus signs. In a query string + usually means a space, but in a path, or in data produced by encodeURIComponent, it may be a real plus. If a phone number such as +44… loses its plus after decoding, turn the plus option off.
• Legacy character sets. Some old systems encode Latin-1 or Shift_JIS bytes instead of UTF-8, producing escapes like caf%E9. Those bytes are not valid UTF-8, so the decoder reports an error instead of guessing.
• Using URL encoding where HTML escaping is needed. Percent-encoding makes text safe inside a URL, not inside a web page. To show < or & in HTML, use the HTML Entity Encoder. To put binary data in a URL, URL-safe Base64 is usually the better fit.

FAQ

Why do I get an error when decoding?

The input has a % that isn’t followed by two hex digits (as in 100%), or a multi-byte sequence was cut short – %E2%82 without the final %AC that would make it €. Check that you copied the whole string. Text that merely contains a percent sign, like a discount, was probably never encoded and shouldn’t be decoded.

Should a space be %20 or +?

In the query part of a URL, servers that read form data treat both as a space. In the path only %20 is correct: /my+file.pdf refers to a file with a plus in its name. When unsure, use %20; every server understands it.

Do I need to encode non-English characters in links?

Browsers show them unencoded in the address bar, but they send the percent-encoded bytes. When you put such a URL into code, an HTTP header, an email template or a sitemap, encode it so every system reads it the same way.

What about domain names with non-ASCII characters?

Hostnames use a separate system, Punycode, which turns bücher.de into xn--bcher-kva.de for DNS. Percent-encoding is meant for the path, query string and fragment.