URL Encode / Decode — Percent-Encoding and URL Parser
Percent-encode or decode text for URLs in component, full-URL or form mode, and edit a URL's query parameters in a table.
encodeURIComponent: for one query value or path segment. Escapes everything except A–Z a–z 0–9 - _ . ! ~ * ' ( ).
name%3DZo%C3%AB%20%26%20Tom%20%2F%20caf%C3%A9%3Fid%3D42%23top
URL parser and query string editor
| Protocol | https: |
|---|---|
| Host | shop.example.com |
| Port | 8443 |
| Path | /search/trail%20shoes |
| Query | ?q=trail+running&size=10&color=blue%20%26%20green&utm_source=newsletter |
| Fragment | #reviews |
| Origin | https://shop.example.com:8443 |
https://shop.example.com:8443/search/trail%20shoes#reviews
Runs entirely in your browser. Nothing you enter is sent to us or stored. Browse all free tools.
Found a problem, or something that could be better? We read every message and we fix things quickly.
This URL encoder and decoder converts text to and from percent-encoding, the %20-style escaping that lets spaces, ampersands, accents and emoji travel safely inside a URL. It offers the three encodings developers actually mix up: component mode for a single query value or path segment (encodeURIComponent), full-URL mode that leaves the URL's own punctuation alone (encodeURI), and form mode, which is what HTML forms and URLSearchParams send, with + for a space.
Decoding is strict on purpose. Where the browser's decodeURIComponent just throws "URI malformed", this tells you which % sequence is broken and where, and whether the bytes are not valid UTF-8 (a common sign that something upstream used Latin-1). Below the encoder, the URL parser splits any URL into its parts and lists the query parameters in an editable table that rebuilds the URL as you change it.
How to use
- Choose Encode or Decode, then the mode: Component for a value you will put into a URL, Full URL for a whole address, Form for application/x-www-form-urlencoded data.
- Type or paste text. The result updates as you type; tick "Each line separately" for a list.
- If decoding fails, read the message: it names the position and the broken sequence.
- To inspect or edit a URL, paste it into the parser, change, add or remove query parameters, and copy the rebuilt URL.
Frequently asked questions
What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent escapes everything except letters, digits and - _ . ! ~ * ' ( ), so it is safe for one piece of a URL, such as a query value that might contain & or =. encodeURI assumes you are giving it a whole URL and leaves the characters that structure a URL (: / ? # @ & = + $ , ;) untouched. Using encodeURI on a value is a classic bug: an & inside the value then splits it into two parameters.
Should a space be %20 or +?
Both are correct in different places. In the query string of a form submission (application/x-www-form-urlencoded), a space is +, and a literal plus must be %2B. Everywhere else, including the path and most hand-built query strings, a space is %20, and + means a literal plus. If a server shows plus signs where spaces should be, or the reverse, the two sides disagree about which rule applies.
Why do I get a "URI malformed" error?
Either a % sign is not followed by two hex digits (for example "100%" or "%zz"), or the bytes form invalid UTF-8, such as %E9 on its own, which is é in Latin-1 but not in UTF-8. A literal percent sign must be written %25. This tool reports the exact position so you can see which one it is.
Which characters need to be URL encoded?
RFC 3986 lets only letters, digits and - . _ ~ appear unencoded anywhere. Reserved characters (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) must be encoded when they appear inside a value rather than as structure. Everything else, including spaces, quotes, < >, non-ASCII letters and emoji, must always be encoded, as the UTF-8 bytes of the character.
Is URL encoding a form of encryption?
No. Percent-encoding is a reversible escaping scheme with no key; anyone can decode it instantly. Never rely on it to hide a token or personal data in a URL. Also remember that URLs end up in browser history, server logs and Referer headers, so secrets do not belong in query strings at all.
Encoding reference: what each mode leaves alone
• Component (encodeURIComponent): leaves A–Z a–z 0–9 - _ . ! ~ * ' ( ). Use for query values, path segments, and anything built by concatenation.
• Full URL (encodeURI): additionally leaves ; , / ? : @ & = + $ #. Use only to clean up a complete URL that contains spaces or non-ASCII characters.
• Form (application/x-www-form-urlencoded): leaves A–Z a–z 0–9 * - . _ and turns spaces into +. This is what URLSearchParams.toString() and HTML forms produce.
• RFC 3986 unreserved set: A–Z a–z 0–9 - . _ ~. The strictest interpretation; encoding ! ' ( ) * as well is always safe.
Non-ASCII characters are always encoded as their UTF-8 bytes: é is %C3%A9, and the emoji 🌲 is four bytes, %F0%9F%8C%B2.
Double encoding and other common bugs
Double encoding happens when an already-encoded string is encoded again: %20 becomes %2520, because the % itself is escaped to %25. If you see %25 followed by two hex digits in a URL, something encoded twice. Decode once and check whether the result still contains % sequences.
The opposite mistake is building a URL by string concatenation without encoding at all. A search for "fish & chips" then sends q=fish and a stray parameter named " chips". Building query strings with URLSearchParams, or encoding each value with encodeURIComponent, prevents both.
Finally, decoding user input and then inserting it into HTML is how reflected cross-site scripting starts. Decode for display only after escaping for HTML; the HTML entity encoder handles that step.
Related free tools
- UTM Link Builder — Build clean, consistent UTM tracking links so you know exactly which campaigns bring you customers.
- Base64 Encoder / Decoder — Encode text or files to Base64, turn images into data URIs with CSS and <img> snippets, and decode Base64 back to a previewable file. Nothing leaves your browser.
- HTML Entity Encoder — Escape text for HTML with named or numeric entities, decode &-style references back to characters, and search an entity reference table.
- JWT Decoder — Decode a JWT's header and payload, read the expiry in plain language, verify HS, RS, PS and ES signatures, or sign a new token. Nothing leaves your browser.