Hunt
Skip to content

URL Encoder / Decoder

Percent-encode text so it's safe in a URL, or decode a URL to read it. Choose how to encode: as one component (like encodeURIComponent), as a whole URL (like encodeURI), or as form data, where spaces become +. Malformed escapes are pinpointed, and double-encoded text is detected.

Runs in your browser

Text

Paste text or press Sample

Encoded

The result will appear here

What URL encoding does

URLs can only contain a limited set of ASCII characters, and some of them (/ ? # & =) have special meanings. Percent-encoding replaces any other character with % and two hex digits per UTF-8 byte: a space becomes %20, é becomes %C3%A9. Decoding reverses it.

How to use the URL Encoder / Decoder

  1. Choose Encode or Decode.
  2. Type or paste the text, or press Sample.
  3. When encoding, choose Component for a single value, Full URL for a whole URL, or Form data.
  4. Copy the result. If the decoded text still contains escapes, press Decode again.

Examples

Encode a query value

Input
rock & roll / 100%
Output
rock%20%26%20roll%20%2F%20100%25

&, / and % are encoded, so the value can't be mistaken for the next parameter or a path.

Encode a whole URL

Input
https://example.com/search?q=café au lait
Output
https://example.com/search?q=caf%C3%A9%20au%20lait

The URL's structure (://, ?, =) is kept; the accented letter and spaces are encoded.

Encode form data

Input
Zoë & Ada
Output
Zo%C3%AB+%26+Ada

The same result as new URLSearchParams({ name: "Zoë & Ada" }) gives for the value.

Decode double-encoded text

Input
caf%25C3%25A9
Output
caf%C3%A9

%25 is an encoded %, so one decode leaves caf%C3%A9. The tool notices and offers to decode again, giving café.

Component, full URL or form data?

Choosing the wrong one is the most common URL-encoding bug.

  • Component (encodeURIComponent) encodes everything except letters, digits and - _ . ! ~ * ' ( ). Use it for a single query value or path segment, so a & or / inside the value can't break the URL.
  • Full URL (encodeURI) keeps the characters that structure a URL (: / ? # & = and others) and encodes the rest, such as spaces and accented letters. Use it only on a complete URL; it won't protect a value containing &.
  • Form data encodes as HTML forms and URLSearchParams do: spaces become +, and ! ' ( ) ~ are encoded too.
  • Strict RFC 3986 is Component plus ! ' ( ) *, for APIs that require it, such as OAuth 1.0 signatures and AWS Signature Version 4.

+ or %20?

In form data and most query strings, + means a space. In a path, + is just a plus sign. Turn on Decode + as space when decoding query strings or form bodies; leave it off for paths. When encoding, Component always writes spaces as %20, which works everywhere.

Options

Encode as
Component for a single value, Full URL for a complete URL, Form data for form bodies and query strings built like URLSearchParams, or Strict RFC 3986.
Decode + as space
Treat + as a space, as form data and most query strings do. Leave it off for URL paths.

Limitations

  • Text is encoded and decoded as UTF-8, as browsers do. Escapes in older encodings such as Latin-1 are reported as invalid.
  • The whole input is encoded as one value. To edit a URL's query parameters one by one, use the URL Parser.

Frequently asked questions

What's the difference between encodeURI and encodeURIComponent?

encodeURI is for a complete URL and leaves / ? # & = alone so the URL keeps working. encodeURIComponent is for one piece of a URL and encodes those characters too. Use encodeURIComponent for values you insert into a URL.

Why do I get URIError: URI malformed?

decodeURIComponent throws it when a % isn't followed by two hex digits, or the escapes don't form valid UTF-8. This tool shows the exact position. A literal % must be encoded as %25.

Should spaces be %20 or +?

Both mean a space in query strings and form data; only %20 means a space in a path. %20 is the safe choice for encoding; when decoding a query string, turn on Decode + as space.

Is my text sent to a server?

No. Encoding and decoding happen in your browser; nothing you paste is uploaded or logged.