UseToolSuite UseToolSuite

URL Encoder / Decoder

Encode and decode URL components, query strings, and full URLs online. Handles percent-encoding and special characters with instant results.

Percent-encoding rules explained

URL encoding (percent-encoding) replaces unsafe characters with a percent sign followed by two hexadecimal digits representing the character's byte value. For example, a space becomes %20, an ampersand becomes %26, and a forward slash becomes %2F. Multi-byte UTF-8 characters produce multiple percent-encoded triplets — the Japanese character 日 encodes as %E6%97%A5 because it requires 3 bytes in UTF-8. RFC 3986 defines which characters are unreserved (never need encoding): A-Z, a-z, 0-9, hyphen, period, underscore, and tilde.

encodeURI vs encodeURIComponent in JavaScript

JavaScript provides two encoding functions with different scopes. encodeURI() encodes a complete URL but preserves characters that have special meaning in URLs: : / ? # [ ] @ ! $ & ' ( ) * + , ; =. Use it to encode an entire URL string. encodeURIComponent() encodes everything except A-Z, a-z, 0-9, and - _ . ~ ! * ' ( ). Use it for encoding individual query parameter values. The most common mistake is using encodeURI() on a parameter value, which fails to encode & and = and breaks the query string.

Reserved vs unreserved: what actually needs encoding

RFC 3986 splits characters into unreserved — letters, digits, -, ., _, ~ — which never need encoding, and reserved — : / ? # [ ] @ ! $ & ' ( ) * + , ; = — which carry structural meaning and must be encoded when used as data. The subtlety is “when used as data”: a / separating path segments stays raw, but a / inside a single segment (a filename) must become %2F. Encoding is therefore per-component, never applied blindly to a whole assembled URL — encoding the full URL would destroy the very separators that make it a URL.

Building query strings that don’t break

Each key and each value must be encoded independently before assembly with = and &. The classic failure: a value containing & or = (a song title, a search phrase) injected raw splits the query string and silently truncates data. In JavaScript, URLSearchParams handles this correctly and is preferred over manual encodeURIComponent chains; in URLs you craft by hand, paste each value through this encoder separately. Watch for # especially — unencoded, it ends the query string and starts a fragment that never reaches the server.

Non-ASCII text: UTF-8 first, then percent

Modern encoding is two steps: text becomes UTF-8 bytes, each byte becomes %XX. Turkish ş is %C5%9F, one character but two encoded bytes. Legacy systems that encoded with ISO-8859 charsets produce different sequences for the same character — the root cause of mojibake in old query strings. International domain names take a different path entirely: the hostname uses Punycode (bücher.de → xn--bcher-kva.de), while only paths and queries use percent-encoding.

Spotting encoding bugs in the wild

Symptoms map to causes: literal %20 displayed to users means decoded-never; %2520 in logs means encoded-twice; broken parameters after a user typed & means encoded-never on input; mojibake like ç for ç means UTF-8 bytes decoded as Latin-1. Paste the suspect string here and decode step by step — each decode peels one layer, and the layer count tells you which component in your pipeline is misbehaving.

URL Encoder / Decoder Powered by UseToolSuite — free browser tools

Last updated

How helpful was this tool?

Click to rate

Embed this tool on your site

Paste this snippet into any HTML page or blog post to embed a live, fully working copy of URL Encoder / Decoder. Free for any use.

Key Concepts

Percent-Encoding

A mechanism for encoding special characters in URLs by replacing them with a % sign followed by two hexadecimal digits representing the character's ASCII or UTF-8 byte value. For example, a space becomes %20 and an ampersand becomes %26. This ensures that reserved URL characters are transmitted literally rather than being interpreted as URL structure.

Query String

The part of a URL that follows the ? character and contains key-value pairs separated by & symbols (e.g., ?name=John&age=30). Query strings pass parameters to the server. Values containing special characters must be percent-encoded to avoid breaking the URL structure.

Reserved Characters

Characters that have special meaning in URL syntax: : / ? # [ ] @ ! $ & ' ( ) * + , ; =. These characters delimit URL components (protocol, host, path, query). When these characters appear as literal data within a URL component, they must be percent-encoded to prevent misinterpretation by parsers and servers.

Frequently Asked Questions

What is the difference between encodeURI and encodeURIComponent?

encodeURI encodes a full URI but preserves characters like :, /, and ? that have special meaning in URLs. encodeURIComponent encodes everything except letters, digits, and a few safe characters. This tool uses encodeURIComponent, which is the correct choice for encoding query parameter values.

Does this tool handle non-ASCII characters like Chinese or Arabic text?

Yes. The encoder converts non-ASCII characters to their UTF-8 byte sequences and then percent-encodes each byte. This is the standard way to include international characters in URLs.

Can I encode an entire URL with query parameters at once?

You can paste an entire URL, but keep in mind that encoding the whole string will also encode the protocol (://) and path separators (/). For best results, encode only the query parameter values individually.

Why does a space sometimes become + and sometimes %20?

Both are correct in different places. %20 is the universal percent-encoding from RFC 3986 and works everywhere in a URL. The + convention comes from the older application/x-www-form-urlencoded format and applies only inside query strings submitted by HTML forms. When decoding, know your source: a + in a form-submitted query string is a space, but a + in a path segment is a literal plus sign.

What is double encoding and how do I fix it?

Double encoding happens when an already-encoded string is encoded again: %20 becomes %2520, because the % itself gets encoded as %25. You'll see it when two layers of a system both 'helpfully' encode (a client SDK plus a proxy, or manual encoding before a library call). Fix it by encoding exactly once, as late as possible — and decode here twice to recover the original value when diagnosing.

Troubleshooting & Technical Tips

URIError: URI malformed — Percent-encoding decode failure

This error occurs when the string being decoded contains invalid percent-encoding sequences (not in %XX format or corrupted UTF-8 byte sequences). For example, incomplete multi-byte UTF-8 sequences like %E2%80 are rejected by decodeURIComponent(). If your input contains a standalone % character, it has not been encoded and must first be encoded as %25. Paste your URL into this tool to identify which segment is malformed.

Double encoding issue: Strange sequences like %2520

If you see %2520 instead of %20 (space) in a URL, the encode function was applied twice to an already-encoded string. The % character gets re-encoded as %25, turning %20 into %2520. Solution: call the encode function only once on the raw string. To check whether data is already encoded, try decoding it first — if the result differs, encoding has already been applied.

Space encoding difference in query strings: + (plus) vs %20

In URL query strings, the space character can be represented in two ways: + (application/x-www-form-urlencoded format) or %20 (RFC 3986 percent-encoding). PHP's urlencode() produces +, while JavaScript's encodeURIComponent() produces %20. If your backend does not interpret the + character as a space, spaces in form data may be lost. Check which format your API expects and use a consistent encoding strategy.

Related Guides

GUIDE

HTTP Status Codes: The Complete Guide for Developers

A complete guide to HTTP status codes: 401 vs 403, the SEO impact of 301 vs 302, 409 for optimistic locking, and how to monitor 5xx errors properly.

GUIDE

Web Security: Encoding and Hashing Guide

Encoding vs hashing vs encryption: when to use Base64, SHA-256, bcrypt, AES, and HTML entity encoding for web security — with examples and decision trees.

Unicode and UTF-8 for Developers: Why Your Emoji Breaks (2026 Guide)

A practical guide to Unicode and UTF-8: code points, encodings, grapheme clusters, normalization, and why string.length lies about emoji and accents.

CORS Errors Explained: Why Your Fetch Call Fails and How to Fix It

A practical guide to CORS: the Same-Origin Policy, debugging OPTIONS preflight, the wildcard-plus-credentials paradox, and fixing it with a reverse proxy.

Related Tools

Base64 Encoder / Decoder

Encoding & Decoding Tools

HTML Entity Encoder / Decoder

Encoding & Decoding Tools

JWT Decoder

Encoding & Decoding Tools

URL Slug Generator

String & Text Tools

URL Parser & Deconstructor

Network & API Tools