URL Encoder / Decoder

About URL Encoding (Percent-Encoding)

URLs may only contain a limited set of ASCII characters. Anything outside that set — spaces, accented letters, emoji, or characters that already have a structural meaning such as ?, &, and = — has to be percent-encoded: the character is converted to its UTF-8 bytes, and each byte is written as a % followed by two hexadecimal digits. A space becomes %20, an ampersand becomes %26, and é becomes %C3%A9. This scheme is defined by RFC 3986 and is what makes it possible to put arbitrary text into a query string without breaking the URL.

Component vs Full-URL Encoding:

• Component encoding (encodeURIComponent): Escapes every reserved character, including / ? : @ & = + $ #. Use it for a single piece of data — one query value, one path segment, one form field. This is the option you want the vast majority of the time.
• Full-URL encoding (encodeURI): Leaves the characters that give a URL its structure intact, so the address still works as an address. Use it only when escaping a complete, already-assembled URL.
• Form encoding (application/x-www-form-urlencoded): Identical to component encoding except that a space becomes + rather than %20. This is what HTML forms submit and what most query strings look like in practice — which is why the decoder here has a toggle for treating + as a space.

Common Mistakes This Tool Helps You Catch:

• Using the wrong function: Encoding a query value with encodeURI leaves & and = untouched, so a value containing them silently splits into extra parameters — a classic source of parameter-injection bugs.
• Double encoding: Passing an already-encoded string through an encoder turns %20 into %2520. Decode here and the tool flags output that is still percent-encoded, with a one-click second pass.
• Malformed sequences: A stray % that is not followed by two hex digits throws URIError: URI malformed. A literal percent sign must be written as %25.
• The + ambiguity: In a query string + means space; in a path it means a literal plus. Decoding with the wrong assumption quietly corrupts data.
• Encoding is not escaping: Percent-encoding makes text safe for a URL. It is not a defence against XSS or SQL injection — output still needs context-appropriate escaping wherever it lands.

Common Use Cases:

• API debugging: Build a query string by hand, or decode one from a log line to see what a client actually sent.
• Redirect and callback URLs: OAuth redirect_uri values must be component-encoded when nested inside another URL.
• Log and traffic analysis: Turn an encoded request line from an access log or proxy capture back into readable text.
• Security testing: Inspect how a target application decodes payloads, and check parameters for encoding-layer confusion.
• Sharing links: Encode search terms, file names, and non-Latin text so links survive copy and paste.

The Inspect URL tab splits any URL into scheme, host, port, path, fragment, and a decoded table of query parameters, so you can see exactly what a long link carries. As with every tool on this site, all processing happens locally in your browser using the standard encodeURIComponent, decodeURIComponent, and URL APIs — nothing is transmitted to a server, which matters when the URLs you are debugging contain tokens or session identifiers.