URL Encoder/Decoder

Encode or decode URL components (escape special characters).

About URL encoding

URLs may only contain a restricted set of ASCII characters. To include anything else — a space, a non-Latin character, an ampersand inside a query value — the byte must be percent-encoded as %XX where XX is the hexadecimal byte value. URL encoding (also called percent-encoding, RFC 3986) is what makes it possible to put a Hindi search query, a JSON blob, or a path with spaces inside a query string without breaking the URL grammar.

This tool encodes and decodes URL components in your browser. It supports both full-URL encoding (preserving reserved characters such as / and ?) and component encoding (which escapes everything that is not a letter, digit or unreserved symbol). Pick the right mode based on whether you are constructing a complete URL or a single query parameter.

Decoded URL data is still untrusted input

URL encoding is not a security boundary — it is a transport convention. A percent-encoded payload looks innocent but every backend decodes it before processing. Treat the decoded value as raw user input and apply the same SQL/HTML/command-injection defences you would for any form field.

How to use

  1. Choose Encode to escape characters into percent-form, or Decode to reverse the process.
  2. Pick component-mode for query parameter values, or full-URL mode if your input is an entire URL.
  3. Paste the source string and read the result instantly.
  4. Copy the result with the button on the output panel.

Common use cases

  • Embedding a search term containing spaces or special characters into a query string.
  • Constructing redirect URLs that round-trip a state value safely.
  • Decoding percent-encoded paths from server access logs.
  • Building OAuth2 authorization URLs whose state and redirect_uri parameters must be encoded.

Frequently asked questions

What is the difference between encodeURI and encodeURIComponent?

encodeURI preserves URL syntax characters (slash, colon, question mark, ampersand) so it is safe for whole URLs. encodeURIComponent escapes those too, which is correct for individual query parameter values.

Why are spaces sometimes encoded as "+" instead of "%20"?

In the application/x-www-form-urlencoded form-data format, spaces become "+". In a URL path or query value per RFC 3986, spaces become "%20". Both are valid in the contexts where they apply.

Can URL encoding hide malicious payloads?

It can obfuscate them, but every modern parser decodes percent-encoding before processing. Treat decoded URL parameters as untrusted user input even if the encoded form looks innocent.

Advertisement