Quick answer: to put a value inside a URL (a search term, an email address, a redirect link), paste it in and press Encode component. To read an encoded string, press Decode component. Tick "Treat + as a space" if the text came from a submitted form.
URLs can only contain a limited set of characters. Anything else, such as a space, an accented letter or an ampersand that is meant as text, has to be written as a percent sign followed by two hexadecimal digits. A space becomes %20, & becomes %26, and é becomes %C3%A9 (its two UTF-8 bytes). That is percent-encoding, usually just called URL encoding, and decoding turns it back.
Which characters need encoding
The rules are in RFC 3986, which sorts characters into three groups:
- Unreserved characters are always safe: the letters A to Z and a to z, the digits 0 to 9, and
- _ . ~. That is 66 characters in total. - Reserved characters give a URL its structure:
: / ? # [ ] @and! $ & ' ( ) * + , ; =. They can appear unencoded when they are doing their job, like the?that starts a query string or the&between parameters. When the same character is part of your data, it must be encoded. - Everything else, including spaces, quotes, non-English letters and emoji, must always be encoded.
That middle group is where most bugs come from. A search for salt & pepper sent as ?q=salt & pepper reaches the server as a search for "salt " plus an empty parameter called " pepper". Encoded as ?q=salt%20%26%20pepper, it arrives intact.
Encode URL or encode component?
The two encode buttons differ in what they leave alone, and picking the wrong one is the most common mistake.
Encode component treats the input as data and encodes every reserved character, including / ? # & = :. It also encodes ! ' ( ) *, which JavaScript's built-in encodeURIComponent() leaves as they are. RFC 3986 and the OAuth 1.0 signing rules both expect those to be encoded, so the stricter output is the safer one. Use it for any single value you are about to put into a URL: a query parameter, a path segment, or a whole URL being passed as a parameter to another URL, such as a redirect target.
Encode URL treats the input as a complete address and keeps its structure. It encodes spaces, non-ASCII characters and a few others, but leaves : / ? # & = and the rest of the reserved set untouched. Use it on a full link that contains spaces or accented characters, to get something you can paste into an email or an HTML attribute. Do not use it to encode a value, because an & or # in the value will be left as structure.
Input: https://example.com/a b?q=café&x=1
Encode URL: https://example.com/a%20b?q=caf%C3%A9&x=1
Encode component: https%3A%2F%2Fexample.com%2Fa%20b%3Fq%3Dcaf%C3%A9%26x%3D1The safest way to build a URL is to encode each value separately with Encode component and then join the pieces with literal ?, = and &.
Decode URL or decode component?
The same split applies in reverse. Decode component turns every percent sequence back into its character. Decode URL deliberately leaves the reserved ones encoded, so %26, %2F, %3F and %23 stay as they are. That keeps the structure of the address from changing: decoding %26 into & inside a query string would split one parameter into two. If you just want to read what an encoded string says, use Decode component.
%20 or +?
Both can mean a space, in different places. In a path, only %20 does. In a query string submitted by an HTML form, browsers use the older application/x-www-form-urlencoded format, which writes spaces as + and a real plus sign as %2B. The encoders here always produce %20, which works in both places. When decoding form data, tick "Treat + as a space"; otherwise a literal + stays a plus.
Where this comes up
- Tracking links. A UTM value like
summer saleoremail #3must be encoded, or the space and the#break the link.utm_content=email #3becomesutm_content=email%20%233. - Redirect and callback URLs. Login flows often pass a whole URL as a parameter, as in
?redirect=. That inner URL must be encoded as a component, or its own?and&will be read as part of the outer one. - API requests. Values with spaces, plus signs or non-English text need encoding in GET parameters. For binary data or tokens, Base64 is often used first, and its
+,/and=then need percent-encoding too. - Debugging. Server logs and analytics tools often show the encoded form. Decode component makes it readable.
One thing that is not percent-encoded: domain names. A non-English domain like münchen.de is converted to a separate ASCII form called Punycode (xn--mnchen-3ya.de), not to percent sequences. Only the path, query and fragment use percent-encoding.
Quick reference
| Character | Encoded | Character | Encoded |
|---|---|---|---|
| space | %20 | ? | %3F |
& | %26 | # | %23 |
= | %3D | @ | %40 |
+ | %2B | % | %25 |
/ | %2F | : | %3A |
Encode or decode a URL
Four modes, strict RFC 3986 component encoding. Nothing is uploaded.
↑ Back to the encoderFrequently asked questions
What is the difference between Encode URL and Encode component?
Encode URL keeps characters that give a URL its structure, such as / ? # & and =, and is meant for a complete address. Encode component encodes those too and is meant for a single value going into a URL, such as a query parameter.
Why didn't Decode URL turn %26 back into &?
Decode URL leaves reserved characters such as &, /, ? and # encoded so that decoding cannot change the structure of the address. Use Decode component to decode every sequence.
Why does my encoded text have + instead of %20?
HTML forms encode spaces as + in query strings. Standard percent-encoding uses %20, which is what this tool produces. When decoding form data, tick "Treat + as a space".
Why do I get a decoding error?
Usually there is a % sign that is not followed by two hexadecimal digits, as in "100%". Encode that % as %25 or remove it, then decode again.
Is my data private?
Yes. Encoding and decoding happen in your browser, and nothing is sent to a server.