URL Encoder / Decoder

Encode text to URL-safe format or decode URL-encoded strings back to readable text. Supports component and full URL encoding.

Text to Encode

Common URL Encoding Reference

Character	Encoded	Description
	%20	Space
!	%21	Exclamation mark
#	%23	Hash
$	%24	Dollar sign
&	%26	Ampersand
'	%27	Apostrophe
+	%2B	Plus sign
/	%2F	Forward slash
:	%3A	Colon
=	%3D	Equals sign
?	%3F	Question mark
@	%40	At sign

Understanding URL Encoding: A Complete Guide

What Is URL Encoding?

URL encoding, also known as percent-encoding, is a mechanism for translating characters into a format that can be safely transmitted within a Uniform Resource Locator (URL). URLs can only be sent over the Internet using the ASCII character set, which means that any characters outside this set — as well as certain reserved characters that have special meaning within URLs — must be converted into a valid ASCII format. URL encoding replaces unsafe characters with a percent sign (%) followed by two hexadecimal digits representing the character's ASCII code. For example, a space character becomes %20, and an ampersand (&) becomes %26.

This encoding standard is defined in RFC 3986, which specifies the syntax for Uniform Resource Identifiers (URIs). Without URL encoding, web browsers and servers would be unable to correctly interpret URLs containing special characters, potentially leading to broken links, security vulnerabilities, and data corruption. Every time you submit a form, click a link with query parameters, or interact with a web API, URL encoding is working behind the scenes to ensure your data arrives safely and accurately.

Component Encoding vs. Full URL Encoding

There are two primary approaches to URL encoding, each serving a different purpose. Component encoding, implemented by JavaScript's encodeURIComponent() function, encodes all characters that have special meaning in a URL, including colons, slashes, question marks, ampersands, and hash symbols. This is the correct choice when encoding individual values that will be placed into query string parameters or path segments. For example, if a user searches for "cats & dogs" on your website, the search query should be component-encoded to "cats%20%26%20dogs" before being inserted into the URL.

Full URL encoding, on the other hand, uses JavaScript's encodeURI() function and is designed to encode an entire URL while preserving its structural characters. It leaves colons, slashes, question marks, and hash symbols intact because these characters define the URL's protocol, path, query string, and fragment. Full URL encoding is useful when you have a complete URL that may contain unsafe characters in its path or query values but whose structure should remain valid. Understanding when to use each type is essential for building web applications that handle URLs correctly and avoid common encoding pitfalls.

Why URL Encoding Matters for Web Development

Proper URL encoding is a fundamental skill for web developers, and misunderstanding it leads to some of the most common bugs in web applications. When query parameters contain unencoded special characters, they can alter the structure of the URL itself. An unencoded ampersand in a parameter value, for instance, will be interpreted as a parameter separator, splitting your intended single value into two separate parameters and causing your application to receive incorrect data. Similarly, unencoded spaces can break URL parsing in some browsers and HTTP clients.

Beyond functional correctness, URL encoding plays a vital role in web security. Improper encoding is a contributing factor in several types of attacks, including cross-site scripting (XSS), SQL injection, and open redirect vulnerabilities. Attackers often exploit double-encoding or incomplete encoding to bypass security filters and inject malicious payloads into URLs. By consistently applying proper URL encoding to all user-supplied data that appears in URLs, developers can significantly reduce their application's attack surface. Modern web frameworks typically provide built-in encoding utilities, and developers should always use these rather than implementing their own encoding logic, which is prone to subtle errors.

Common Use Cases and Best Practices

URL encoding is essential in numerous web development scenarios. When building RESTful APIs, all dynamic path segments and query parameters must be properly encoded to handle arbitrary user input. When constructing redirect URLs, encoding ensures that the target URL is passed as a single parameter without breaking the redirect mechanism. In email marketing, encoded URLs within tracking links preserve analytics parameters through multiple redirects. When working with OAuth and authentication flows, proper encoding of callback URLs and state parameters prevents authentication errors and security issues.

Best practices for URL encoding include always encoding user input before inserting it into URLs, using language-provided encoding functions rather than manual string replacement, being aware of double-encoding issues (where already-encoded strings get encoded again, turning %20 into %2520), and testing your application with special characters including international characters, emoji, and control characters. It is also worth noting that the plus sign (+) is sometimes used as an alternative encoding for spaces in query strings (application/x-www-form-urlencoded format), which differs from the standard percent-encoding where spaces become %20. This distinction often causes confusion, so always verify which encoding convention your API or framework expects and be consistent throughout your application.

How to Use This Tool

1
Select Encode or Decode mode
Click "Encode" to convert plain text to URL-safe format, or "Decode" to convert URL-encoded strings back to readable text.
2
Choose Component or Full URL encoding
Use "Component" for encoding individual query parameter values (encodes all special characters). Use "Full URL" to encode a complete URL while preserving its structural characters like colons and slashes.
3
Enter your text or URL-encoded string
Type or paste your input into the text area. For encoding, enter plain text. For decoding, enter a percent-encoded string like "Hello%20World%21".
4
Click Encode or Decode
Press the blue action button to process your input. The result appears below with a "Copy" button and an optional character-by-character breakdown showing which characters were encoded.
5
Use Swap or Bulk Mode for advanced workflows
Click "Swap" to reverse the operation and use the output as new input. Enable "Bulk Mode" to encode or decode multiple URLs at once, one per line.

Frequently Asked Questions

What is the difference between Component and Full URL encoding?▼

Component encoding (encodeURIComponent) encodes all special characters including colons, slashes, and ampersands. Use this for individual query parameter values. Full URL encoding (encodeURI) preserves the URL structure characters, making it suitable for encoding a complete URL that may contain non-ASCII characters.

Why do spaces become %20 instead of the plus sign (+)?▼

The %20 encoding is the standard percent-encoding defined in RFC 3986. The plus sign (+) for spaces is a convention specific to the application/x-www-form-urlencoded format used in HTML form submissions. Our tool uses the standard percent-encoding, which is more universally compatible across APIs and systems.

What is double encoding and how do I avoid it?▼

Double encoding happens when an already-encoded string gets encoded again, turning %20 into %2520. To avoid this, always check whether your input is already encoded before encoding it again. If your input contains percent signs followed by two hex digits, it is likely already encoded and should be decoded first.

Can I use this tool for encoding non-English characters?▼

Yes. This tool fully supports UTF-8 encoding, so characters from any language — including Chinese, Japanese, Korean, Arabic, Cyrillic, and emoji — are properly encoded to their percent-encoded byte sequences and can be decoded back to the original text.

Is this tool safe for encoding sensitive data?▼

Yes, all encoding and decoding happens entirely in your browser. No data is sent to any server. However, remember that URL encoding is not encryption — it only makes text URL-safe. Never put sensitive information like passwords directly in URLs, regardless of encoding.