URL Encoder/Decoder

About URL Encoder/Decoder

Only a limited set of characters may appear in a URL. Spaces, non-ASCII letters, and characters that carry structure — ? & = # / — have to be written as % followed by two hex digits when they are part of a value. That's percent-encoding, also called URL encoding. “café” becomes caf%C3%A9 because é is two bytes in UTF-8.

The tool has two modes. Component uses JavaScript's encodeURIComponent and encodes a single piece, such as one query value, completely. Full URL uses encodeURI and treats the input as a finished address, leaving its structural characters alone. Picking the wrong one is the most common source of broken links.

The three kinds of characters in RFC 3986

RFC 3986, the generic URI syntax, sorts characters into three groups. Unreserved characters — letters, digits, - . _ ~ — can always appear as-is. Reserved characters mark structure: the gen-delims (: / ? # [ ] @) separate the big parts of a URL, and the sub-delims (! $ & ' ( ) * + , ; =) are used within them. Everything else — spaces, non-ASCII, %, quotation marks — must be encoded.

The key rule is that a reserved character stays literal when it's acting as structure and gets encoded when it's data. If someone searches for “a&b”, ?q=a&b is read as q=a plus a second parameter b; only ?q=a%26b delivers the value intact.

encodeURI vs encodeURIComponent

encodeURIComponent (Component mode) leaves only letters, digits and - _ . ! ~ * ' ( ) unencoded. encodeURI (Full URL mode) additionally leaves ; , / ? : @ & = + $ #. Put a whole address through Component and you get https%3A%2F%2F…, which no longer works as a link. Put a query value through Full URL and any & or + in it survives and corrupts the query.

A realistic trap: the search term “C++ & Java”. Encoding the whole address in Full URL mode gives ?q=C++%20&%20Java. The server reads q as “C ” (each + turns into a space) and treats “ Java” as a separate, nameless parameter. Encoding just the value in Component mode gives C%2B%2B%20%26%20Java, which arrives intact. The rule of thumb: build the skeleton of the URL yourself and component-encode each value you insert.

The five characters encodeURIComponent leaves alone — ! ' ( ) * — are sub-delims in RFC 3986. Most servers don't care, but anything that demands strict RFC 3986 encoding, such as OAuth 1.0 signature base strings, needs them as %21 %27 %28 %29 %2A or the signature won't match. MDN documents a small wrapper for exactly this.

encodeURI also escapes [ and ], so an IPv6 host like http://[::1]/ comes out as http://%5B::1%5D/ — another reason to run it only on paths and values you control, not on arbitrary finished URLs.

Space: %20 or +?

Both, in different places. In RFC 3986 percent-encoding, a space is %20. The + convention comes from the HTML form format application/x-www-form-urlencoded: when a browser submits a form with GET, spaces in the query string are written as +. URLSearchParams follows the same rules, so q = “a b+c&d” serializes as q=a+b%2Bc%26d.

This tool encodes with encodeURIComponent and therefore writes %20; servers read either as a space. When decoding, it applies the form rule and turns + into a space — across the whole input in Component mode, and only in the query string (after ?) in Full URL mode, because in a path + is just a plus sign. One consequence: if a value containing + (a Base64 token, a phone number like +1 555…) was dropped into a query string unencoded, it has already become a space by the time the server reads it. Going the other way, turn off the “+ = space” option when decoding a non-form string such as a Base64 token, and every + is kept.

Why decoding fails

Decoding fails when a % isn't followed by two hex digits (“100%” is a common culprit) or when the bytes don't form valid UTF-8. Legacy URLs encoded in a non-UTF-8 charset trigger the second case: Windows-1252 writes é as the single byte %E9, which isn't valid UTF-8 on its own. The tool then says the text may be in a legacy encoding, and when the bytes also read cleanly as EUC-KR or Shift_JIS it shows those readings as suggestions (%93%FA%96%7B → Shift_JIS: 日本). Double encoding is the other classic: encode a%20b again and the % becomes %25, giving a%2520b. If a decoded result still contains %20-style sequences, the value was probably encoded twice.

Worked examples

How to use it

1. Choose Component for a single value or path segment, Full URL for a complete address.
2. Paste the text to encode, or the %-encoded string to decode.
3. Use the swap button to run the result back and confirm it matches the original.

Frequently asked questions