Free URL Encoder and Decoder
Percent-encode a single value or a full link, and decode escapes like %20 and %C3%A9 back into readable text.
What is an URL Encoder and Decoder?
A URL encoder replaces characters that can’t appear in a web address with a percent sign and two hex digits, such as a space with %20. A URL decoder reverses that, so a link or query string becomes readable again.
This tool uses the same rules browsers apply through JavaScript’s encodeURIComponent and encodeURI, defined by RFC 3986 and the ECMAScript standard. Non-ASCII characters are encoded as UTF-8 bytes first, so é becomes %C3%A9. Component mode is for one value inside a URL; Address mode is for a complete link whose slashes and question mark must keep working.
Key Features
Values and Whole Links Handled Differently
Component mode escapes &, = and / so a value can’t break the query around it. Address mode leaves those alone, so a full URL still points where it should.
Broken Escapes Located for You
When decoding fails, the error quotes the bad sequence and its position in the string. A stray % in “100%” shows up as character 4, not a vague failure.
Any Language, Any Emoji
Text is turned into UTF-8 bytes before encoding, so Japanese, Arabic and emoji all survive the round trip. 😀 becomes the four escapes %F0%9F%98%80.
Unsafe Byte Runs Refused
Overlong UTF-8 such as %C0%AF, an old trick for sneaking a slash past filters, is rejected as invalid instead of decoded. That makes the decoder safe for reviewing suspicious links.
Links Never Leave the Page
Everything runs in your browser, so internal hostnames, tokens and customer IDs in a URL aren’t sent anywhere. There is nothing to upload.
Perfect for everyone
- Web developers building query strings
- Marketers checking UTM links
- Support engineers reading redirect URLs
- Penetration testers reviewing encoded payloads
How to Use the URL Encoder and Decoder
Choose what you are encoding, paste it, and copy the result.
Choose Component or Address
Use Component for a single value going into a query string or path, such as a search term or a filename. Use Address only when you are encoding an entire link that must stay clickable.
Paste the Text or the Encoded String
Type or paste into the source field. Pick Decode component to turn every escape back into text, or Decode address to keep reserved escapes like %2F so the link’s structure doesn’t change.
Check the Result or the Error
The converted string updates on every keystroke. If a decode fails, the red line quotes the exact escape that broke it, so you can fix that one spot instead of retyping the whole link.
Paste It Into Your Link
Copy the result into your query string, API request or redirect parameter. The In and Out counts show how much longer encoding made the text, which matters for URLs near length limits.
Real Encodings and Decodings
Every row below is an input we ran through this tool and the exact text it returned, error messages included. Work one out yourself before revealing it.
“Ham & Cheese / 2 people?”
“https://example.com/search?q=café au lait&page=2”
“emoji 😀”
“caf%C3%A9%20au%20lait”
“https%3A%2F%2Fexample.com%2F%3Fq%3D1”
“https://example.com/a%2Fb?q=x%26y”
“name=Ada+Lovelace”
“100%”
“%E2%82”
“%C0%AF”
Characters That Get Percent-Encoded
Percent-encoding writes a byte as % plus two hex digits. These are the characters people most often need to encode or decode, and the rule behind each.
Space Is %20
A space is byte 32, hex 20, so it always encodes as %20 in a URL. HTML forms send it as + instead, which is a different scheme.
“How does a space encode?”
Ampersand Separates Query Parameters
An unescaped & starts a new parameter, so a value containing one must carry %26. Component mode does this; Address mode leaves it as a separator.
“How does & encode inside a value?”
Slash Splits Path Segments
Inside a single path segment or a query value, a slash must be %2F or the server sees an extra folder level.
“How does / encode inside a value?”
Question Mark Starts the Query
The first question mark ends the path and starts the parameters. A literal question mark in a search term becomes %3F.
“How does ? encode inside a value?”
Hash Starts the Fragment
Everything after # stays in the browser and is never sent to the server. A # inside a value must be %23 or the rest of the URL is cut off.
“How does # encode inside a value?”
Equals Joins a Name and Value
In key=value pairs the first = is structure, and any = inside the value should be %3D. Base64 values in URLs often end in = and need this.
“How does = encode inside a value?”
Plus Must Be Escaped to Mean Plus
Many servers read + in a query as a space, so a real plus sign, as in C++, travels as %2B.
“How does + encode inside a value?”
Percent Escapes Itself
A literal % starts an escape, so it is written %25. Seeing %2520 in a URL means a %20 was encoded a second time.
“How does % encode?”
Non-ASCII Becomes UTF-8 Bytes
é is two bytes in UTF-8, C3 and A9, so it encodes as two escapes. Emoji take four bytes and four escapes.
“How does é encode?”
Some Characters Are Never Encoded
Letters, digits, hyphen, underscore, period and tilde are unreserved in RFC 3986 and pass through unchanged. JavaScript’s component encoding also leaves the exclamation mark, asterisk, apostrophe and parentheses alone.
“Does a hyphen get encoded?”
Component, Address and Form Encoding
Three schemes look alike but disagree on which characters to escape and how a space is written.
Component Encoding for Single Values
Matches encodeURIComponent and escapes everything except letters, digits and - _ . ! ~ * ' ( ). Use it for every query value and path segment you insert.
Address Encoding for Whole Links
Matches encodeURI and also keeps reserved characters such as the hash, ampersand, slash, colon, equals sign and question mark, so a complete URL keeps its structure. Only spaces, non-ASCII text and a few symbols change.
Form Encoding Writes Spaces as Plus
HTML forms submit application/x-www-form-urlencoded data, where a space is +, not %20. This tool doesn’t turn + into a space, so replace it first if your input came from a form.
Decoding an Address Keeps Its Structure
Decode address leaves %2F, %3F, %26 and the other reserved escapes alone, because decoding them could change what the URL means. Decode component turns all of them back into characters.
Domain Names Use Punycode
International domain names such as bücher.example are written as xn-- labels in DNS, not as percent-escapes. Encode only the path and query with this tool.
Double Encoding Shows Up as %25
When an already encoded string is encoded again, each % becomes %25, so %20 turns into %2520. Decode once per layer until the text reads normally.
URL Encoding Mistakes to Avoid
These cause most broken links and most decode errors.
Encode Each Value, Not the Joined String
Encode every query value on its own, then join them with & and =. Encoding the finished query string turns your separators into %26 and %3D.
Don’t Use Component Mode on a Full URL
Component encoding turns https:// into https%3A%2F%2F and the link stops working. Use Address for whole links.
Write a Literal Percent as %25
A discount like 20% off breaks decoding because % expects two hex digits. Encode the value first and the % becomes %25.
Watch for Plus Signs From Forms
Data copied from a form submission uses + for spaces. Swap + for %20 before decoding here, or names like Ada+Lovelace stay joined.
Old Links May Not Be UTF-8
Very old sites encoded é as %E9 in Latin-1, which isn’t valid UTF-8 and fails to decode. Re-encode the text as UTF-8 at the source.
Fragments Never Reach the Server
Anything after # stays in the browser, so a tracking value placed there is never logged server-side. Move it into the query string.
Decode Twice When You See %25
A link full of %2520 and %253A was encoded twice. Run Decode component two times and compare the results to find the original.
Mind URL Length Limits
Encoding can triple the length of non-English text, since each character becomes up to three or four escapes. Common servers such as nginx reject request headers over 8 KB by default, so move large values into a POST body.
Where URL Encoding Comes Up
Any time text goes into a link, something has to be encoded.
Building an API Request by Hand
Encode a search term or filter value before adding it to a GET request in curl or Postman. Spaces and & in the value then can’t break the query.
Reading a Login Redirect
Sign-in links carry the return address in a parameter such as redirect_uri or returnTo, encoded with %3A%2F%2F. Decode it to see exactly where the user will land.
Checking UTM Campaign Links
Decode a tracking link to confirm utm_campaign and utm_content say what the report will show. A stray space or & in a campaign name is easy to spot once decoded.
Fixing Links With Spaces
A CMS link to “Annual Report 2026.pdf” breaks in some email clients. Encode the filename and the link works everywhere.
Reading Server Access Logs
Web server logs record request paths still percent-encoded. Decode a line to read the search terms and file names users actually requested.
Reviewing Suspicious Links
Attackers hide path traversal as %2e%2e%2f or overlong bytes like %C0%AF. Decoding shows the real path, and invalid UTF-8 is flagged instead of silently passed through.
Passing a URL Inside Another URL
Share links and webhooks often carry one full URL as a parameter of another. Encode the inner link with Component so its own question mark and ampersands stay inside the value.