URL Encode / Decode
Free URL encoder and decoder. Percent-encode text for safe URLs or decode encoded URLs back to readable text.
URLs may only contain a restricted set of ASCII characters. Anything else — spaces, accented letters, ampersands inside a value, emoji — must be percent-encoded, or the URL will be truncated, misparsed or rejected.
This tool encodes text for safe use in URLs and decodes encoded URLs back into readable form. Everything runs in your browser.
How to use the URL Encode / Decode
Paste your text or URL
Plain text to encode, or a percent-encoded string to decode.
Choose the direction
Encode makes text URL-safe; decode turns
%20and friends back into readable characters.Copy the result
One click copies the output.
How percent-encoding works
Each unsafe character is replaced by % followed by its byte value in hexadecimal. A space becomes %20, & becomes %26, / becomes %2F.
Non-ASCII characters are first converted to UTF-8, then each byte is encoded separately. That is why é becomes %C3%A9 — two bytes, two escapes — and why an emoji can expand to four.
Characters you must encode
| Character | Encoded | Why |
|---|---|---|
| space | %20 | Terminates the URL in many parsers |
& | %26 | Separates query parameters |
= | %3D | Separates a parameter name from its value |
? | %3F | Starts the query string |
# | %23 | Starts the fragment — everything after is not sent to the server |
/ | %2F | Separates path segments |
+ | %2B | Means a space in form-encoded data |
% | %25 | Starts an escape sequence itself |
Encoding a whole URL versus a single value
This is the distinction that causes most bugs. Encoding an entire URL escapes the :// and / that give it structure, producing something unusable. Encoding only a *value* leaves the structure intact.
In JavaScript, encodeURIComponent() encodes a single value and is what you want for query parameters. encodeURI() encodes a whole URL and deliberately leaves structural characters alone. Reach for encodeURIComponent() in almost every case.
Concretely: ?q= + encodeURIComponent("fish & chips") gives ?q=fish%20%26%20chips, which parses correctly. Without encoding, & chips is read as a second parameter.
The plus sign problem
HTML forms submitted as application/x-www-form-urlencoded encode spaces as + rather than %20, for historical reasons. Both appear in the wild, and decoders disagree about which to accept.
The practical consequence: a literal plus sign in a value — common in email addresses like user+tag@example.com — must be encoded as %2B, or it will decode to a space and the address will break. This is a genuinely frequent bug in signup forms.
Practical uses
- Building search and filter URLs with user-entered text.
- OAuth redirect parameters, where a whole URL is passed as the value of another URL’s parameter and must be fully encoded.
- UTM campaign tags containing spaces or punctuation.
- Debugging analytics links — decoding a long tracking URL makes its parameters readable.
- Deep links and share URLs carrying titles or messages.
Frequently asked questions
What is URL encoding?
Replacing characters that are unsafe in a URL with a percent sign followed by their hexadecimal byte value — a space becomes %20. It is also called percent-encoding.
Why is a space %20 sometimes and + other times?
%20 sometimes and + other times?Percent-encoding uses %20. HTML form submissions use + for historical reasons. Both are seen in practice, which is why a literal plus must be encoded as %2B to avoid being read as a space.
What is the difference between encodeURI and encodeURIComponent?
encodeURI encodes a whole URL and leaves structural characters like / and ? alone. encodeURIComponent encodes a single value and escapes them. Use the latter for query parameter values.
Do I need to encode the whole URL?
Usually not — encode only the values you insert into it. Encoding the whole thing escapes :// and /, producing a URL that no longer works.
Why does my email address break in a URL?
The + in addresses like user+tag@example.com decodes to a space in form-encoded contexts. Encode it as %2B.
How are emoji and non-English characters encoded?
They are converted to UTF-8 first, then each byte is percent-encoded. é becomes %C3%A9; an emoji typically becomes four escapes.
Is URL encoding a security measure?
No. It ensures correct parsing, not safety. Preventing injection requires proper escaping for the destination context and parameterised database queries.
Is my data sent anywhere?
No. Encoding and decoding happen entirely in your browser.
100% private. Files are processed on your device and never uploaded.
Instant results. No upload queue. Processing time depends on your device.
Free forever. No signup, no watermark, no paid tier.
Works everywhere. Use a modern browser on your phone or computer.
Related tools
URL Encode / Decode is one of all the free tools on ToolNest. No account or subscription needed — anywhere in the world.