URL Encoder / Decoder
Percent-encode URL components or decode %xx sequences back to readable text instantly.
How to use this tool
- 1Paste your raw text or percent-encoded string into the left 'Input' textarea.
- 2Click Encode to convert special characters to %XX sequences, or Decode to convert %XX sequences back to readable text.
- 3The result appears in the right 'Output' textarea ready to copy.
- 4If decoding fails due to a malformed sequence, a red error message is shown.
About URL Encoder / Decoder
This URL encoder and decoder applies component encoding rules so you can move text safely into and out of URLs. A space, ampersand, or non-ASCII letter can split parameters, break signatures, or mangle redirects if you forget percent-encoding.
You run into this when building OAuth redirect URIs, search query parameters, webhook callback URLs, or spreadsheet formulas that open links. Raw UTF-8 in a path may work in modern browsers and fail in an older gateway. Double-encoding creates sequences like %253A that are hard to read. Under-encoding lets an ampersand chop your value into a second parameter. Encoding an entire URL including the scheme when you only needed a query value is a common mistake.
Paste raw text and encode to percent-encoded sequences, or paste encoded text and decode back. Encoding follows the encodeURIComponent-style treatment of characters that must be escaped in components. Decoding reverses %XX sequences and surfaces an error when a malformed escape appears. Output is ready to copy. Work stays in the browser.
The split between encodeURI and encodeURIComponent semantics matters: encoding a full URL with a component encoder will escape :, /, and ? and break the structure. Decode carefully when plus signs represent spaces in application/x-www-form-urlencoded bodies — some forms use + while encodeURIComponent uses %20.
Encode a search keyword with spaces before appending it to a query. Decode a mysterious tracking parameter to see the original campaign name. Prepare redirect_uri values that must match an allowlist byte-for-byte after encoding. Fix a broken share link that shows % sequences in the UI by decoding for display. Clean parameters copied from analytics exports before replaying them.
Searches like url encode online space to %20, decode percent encoding string, encodeuri component tool, and fix malformed % sequence in url point at this utility. It does not shorten links, resolve DNS, or validate that a URL is reachable.
Encoding a complete URL string for use as a single query value is correct; encoding it for use as a navigable address is wrong. Incomplete % at the end of a string fails decode. Decoding already-plain text may leave it unchanged or behave oddly if stray % signs exist. Non-UTF-8 legacy encodings are outside this tool's comfort zone.
Query parameters can contain tokens and PII. Encoding locally avoids shipping them to a third-party encoder API. Still clear the fields after debugging authenticated URLs on a shared computer.
Double encoding usually appears when both a frontend and a gateway encode the same value. The symptom is literal %25 sequences in logs. Decode stepwise until you see readable text, then fix the duplicate hop rather than adding a third encode to make it work.
Signed URLs deserve extra care: encode parameter values before computing signatures exactly as the signer expects, including whether spaces become %20 or +. Signature mismatches after helpful re-encoding are a frequent outage class. Keep a canonical example in your repo that shows the exact encoded form the signer produces.
Code examples
JavaScript
const encoded = encodeURIComponent("hello world & more");
// → "hello%20world%20%26%20more"
const decoded = decodeURIComponent(encoded);Python
from urllib.parse import quote, unquote
encoded = quote("hello world & more")
decoded = unquote(encoded)Frequently asked questions
Component encoding escapes reserved characters including slashes and colons. That is correct when the entire URL is a single parameter value, and wrong when you needed a clickable address. Encode only the parts that are data, not the scheme and host structure. This scenario is the most common misuse of URL encoders.
Incomplete or illegal % escapes should trigger a decode failure message instead of silently inventing characters. Fix the source string by restoring two hex digits after each %. Retry decode after repair. Truncated log lines often produce this exact failure mode. In practice, re-run URL Encoder / Decoder on a smaller sample after each change so you can see which input detail caused the mismatch. Keep the original nearby until you trust the export.
Empty input typically encodes to an empty string without throwing. That edge case is easy to miss in automated tests that forget to pass a value. If you expected %20 or similar, your source never contained a space. Confirm the input before filing a bug against the encoder.
encodeURI leaves many reserved URL structural characters intact for full-URL use. encodeURIComponent escapes more aggressively for query values and path segments. This tool follows the component-oriented path for data safety. Pick the flavor that matches whether you are mutating a whole URL or a single field.
Percent-encoding is the native URL mechanism for reserved characters in text. Base64 is for arbitrary bytes and still usually needs percent-encoding when placed in queries because + and / are special. Prefer percent-encoding for ordinary strings. Combine both only when a protocol demands Base64 payloads inside URLs.
application/x-www-form-urlencoded historically maps + to space, while decodeURIComponent treats + as a literal plus and expects %20 for spaces. Know which encoding your producer used. Replace + with %20 before component decode if you are dealing with form bodies. Mismatched form encoding is a frequent integration scenario.
Partial encoding is fragile because a lone % can invalidate decode. Normalize the producer so values are fully encoded or fully plain, then transform once. Attempting repeated decode passes on mixed text creates confusing artifacts. Fix the generator when you see this pattern in logs.
Component encoding emits UTF-8 based percent sequences for non-ASCII text, which modern stacks expect. Legacy systems that want another charset may still misinterpret the bytes. Test against the receiving server with a non-ASCII sample. Do not assume success on English-only trials alone. In practice, re-run URL Encoder / Decoder on a smaller sample after each change so you can see which input detail caused the mismatch. Keep the original nearby until you trust the export.