About this tool
This free URL encoder / decoder percent-encodes text so it is safe to drop into a URL or query string, and turns an encoded URL back into readable text.
It handles UTF-8 properly, so accented letters, emoji and non-Latin scripts encode and decode without corruption. Everything runs in your browser — nothing is uploaded.
What percent-encoding is
A URL is allowed to contain only a small set of characters. Everything else — spaces, quotes, &, #, ?, accented letters, anything in Chinese or Arabic — has to be rewritten before it can travel safely.
Percent-encoding does that by replacing a character with a % followed by its byte value in hexadecimal. A space becomes %20. An ampersand becomes %26. A question mark becomes %3F. It is the same idea as Base64 — make awkward data safe for a channel that is fussy about what it carries — but done character by character, so the result stays mostly readable.
Because it encodes bytes, a character that takes more than one byte in UTF-8 produces more than one escape. é is two bytes, so it becomes %C3%A9. A Chinese character is usually three bytes and becomes three escapes. An emoji is four. That is why encoded URLs with non-English text look so long.
Why it matters: the `&` problem
Here is the bug this tool exists to prevent, and almost everyone hits it once.
A query string separates its values with & and =:
/search?q=coffee&page=2
Now suppose someone searches for Bed & Breakfast. Put it in raw:
/search?q=Bed & Breakfast&page=2
The server now sees three parameters — q is Bed , then a nonsense parameter Breakfast, then page. The search silently returns the wrong thing. Encode the value first and it works:
/search?q=Bed%20%26%20Breakfast&page=2
The rule that follows: encode each value, not the whole URL. The & and = that structure the query string must stay raw. The & inside a value must not.
Encoding a value vs encoding a whole URL
This is the distinction that trips people up, and it is why two different JavaScript functions exist.
encodeURIComponent encodes almost everything, including /, ?, #, & and =. Use it for one piece of a URL — a search term, a filename, a redirect target, a token. This is what you want most of the time, and it is what this tool does.
encodeURI leaves the structural characters alone, because it assumes you are handing it a complete, already-correct URL and just want the illegal characters cleaned up. Use it on a whole URL, never on a single value.
Encode a whole URL with the component version and every / turns into %2F — the address stops working. Encode a value with the URI version and your & sails straight through and breaks the query string. Knowing which one you meant is the whole trick.
Not the same as HTML escaping
Percent-encoding and HTML escaping look similar and solve different problems.
Percent-encoding (%20, %26) makes text safe inside a URL. HTML escaping (&, <) makes text safe inside an HTML document. A URL printed on a page may need both, applied in that order — first encode it for the URL, then escape the result for the HTML.
And a familiar oddity: + sometimes means a space. That is a leftover from HTML form submissions, where application/x-www-form-urlencoded uses + for a space instead of %20. Most servers accept both in a query string, but + in a path means a literal plus sign. If a space turns up as a + where you did not expect it, a form encoder is the reason.
How to use it
- Paste your text or URL into the box
- Encode or Decode with the buttons
- Swap to feed the result back in and go the other way
- Copy the result
Good to know
- Encode values, not whole URLs. Running a complete address through an encoder turns every / into %2F and breaks it.
- Never encode twice. A % is itself encoded as %25, so a double pass turns %20 into %2520 and the space is lost. This is the most common cause of a mysteriously broken link.
- Reserved characters are : / ? # [ ] @ ! $ & ' ( ) * + , ; =. They are legal in a URL but carry meaning, so they must be encoded when they appear inside a value.
- Unreserved characters are never encoded: A–Z, a–z, 0–9, -, _, . and ~.
- Case does not matter in the hex. %3f and %3F are the same. Uppercase is the convention.
- A lone % is invalid. If decoding fails, look for a % that is not followed by two hex digits — often a sign the string was cut short.
Common questions
What does %20 mean in a URL?
It is a space. Space is not allowed in a URL, so it is percent-encoded as %20 — % followed by 20, the hexadecimal byte value of a space. You may also see a space written as +, which comes from HTML form encoding; both are widely understood in a query string, but only %20 is correct in a path.
Should I encode the whole URL or just part of it?
Just the parts. Encode each value you are putting *into* a URL — a search term, a filename, a redirect address — and leave the ://, /, ?, & and = that give the URL its structure alone. Encoding a complete URL turns its slashes into %2F and stops it resolving.
Why did my link break after encoding it?
Almost always double encoding. The % character is itself encoded as %25, so encoding an already-encoded string turns %20 into %2520. The decoder then gives you back a literal %20 instead of a space. Decode it once to check what you actually have before encoding again.
Why does one accented letter become several % codes?
Because percent-encoding works on bytes, not letters. In UTF-8, é is two bytes, so it becomes %C3%A9. Most Chinese, Japanese and Korean characters are three bytes and become three escapes; emoji are four bytes and become four. Nothing is wrong — that is just what the character weighs.
What is the difference between URL encoding and HTML escaping?
They protect different places. URL encoding (%26) makes text safe inside a web address. HTML escaping (&) makes text safe inside an HTML page. A link printed on a page can need both, applied in that order. Using one where the other belongs leaves the original problem unsolved.
Is my text sent to a server?
No. The encoding and decoding both happen in your browser, so nothing you paste leaves your device. The tool keeps working with your connection turned off.
Related tools
- Base64 Encode / Decode — the other encoding you meet constantly in tokens and data URLs
- JSON Formatter — tidy and check the JSON that often travels in those query strings
- JWT Decoder — read a token that arrived in a URL
- Extract Emails and URLs — pull every link out of a block of text
