URL Encoder / Decoder

Using the encoder and decoder

1. Paste text into the Input box. This is usually one value that will go into a URL, such as a search term or a file name.
2. Encode changes special characters into %XX codes. It uses the browser's encodeURIComponent() function.
3. Decode changes %XX codes back into characters. It uses decodeURIComponent().
4. Treat + as space is off by default. Turn it on before you press Decode when the text came from an HTML form or a query string. Then every + becomes a space.
5. Copy copies the Output box. The button reads Copied! for a moment when it works.

If Encode or Decode fails, a message under the buttons says why, and the Output box is cleared. So you cannot copy an old result by mistake. Encode fails only in one rare case: the text has a broken character, such as half of an emoji copied from another program.

What Encode changes: a worked example

Encode the text a b&c=d/é and you get:

a%20b%26c%3Dd%2F%C3%A9

Each special character became a % sign and two hex digits. Characters outside English, like é, are first turned into UTF-8 bytes. Then each byte gets its own code. é is two bytes, so it becomes %C3%A9.

Encode leaves these characters as they are: A-Z a-z 0-9 - _ . ~ ! ' ( ) *.

The last five (! ' ( ) *) are a known gap in encodeURIComponent. They are safe in most URLs. But a few strict systems, such as OAuth 1.0 signatures, need them encoded as well. In JavaScript you can add this step yourself:

encodeURIComponent(text).replace(/[!'()*]/g,
  c => '%' + c.charCodeAt(0).toString(16).toUpperCase())

Encode one value, not the whole URL

This tool encodes everything that has a meaning in a URL, including :, /, ? and &. That is exactly right for a single value. It is wrong for a full address. Paste a full URL and you get this:

Input:  https://example.com/search?q=red shoes&page=2
Output: https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dred%20shoes%26page%3D2

That output no longer works as a link. Instead, encode only the value and put it into the URL yourself. For the search term red shoes & socks:

Value:   red shoes & socks
Encoded: red%20shoes%20%26%20socks
URL:     https://example.com/search?q=red%20shoes%20%26%20socks&page=2

If you did not encode the value, the & would end the q parameter. The server would read q as red shoes and treat socks as a separate, empty parameter.

JavaScript has a second function, encodeURI(), for full URLs. It keeps : / ? & = # and only encodes things like spaces and non-English letters. This tool does not offer it. In the example above, encodeURI would give https://example.com/search?q=red%20shoes&page=2.

Decoding: plus signs and errors

By default, a plus sign stays a plus sign. decodeURIComponent does not turn + into a space. So red+shoes decodes to red+shoes. But HTML forms and many query strings use + for a space. For that kind of text, turn on Treat + as space. Then red+shoes decodes to red shoes. A real plus sign in form text is written %2B, so it stays correct: a%2Bb+c decodes to a+b c. Leave the option off for other text, such as a path or a Base64 value, where + really means a plus sign.

Broken codes give an error. Decode stops with Invalid encoded string for any of these:

If one bad code appears anywhere in the input, nothing is decoded. When the problem is a % without two hex digits, the message tells you its position, counting from 1. Fix or remove that part, then try again.

Decode removes one layer at a time. %2520 decodes to %20, not to a space. That means the text was encoded twice. Press Decode again to remove the second layer.

Common mistakes

• Encoding twice. Encoding %20 gives %2520, because the % is encoded again. This often happens when a library already encodes values and you encode them first as well. The server then sees %20 as text instead of a space.
• Mixing up functions in other languages. new URLSearchParams({q: "a b"}) in JavaScript writes q=a+b, with a plus. Python's urllib.parse.quote("a b/c") gives a%20b/c and keeps the slash, unless you pass safe="". Results that differ from this tool are often correct for their own purpose.
• Hiding secrets. Percent-encoding is not encryption. Anyone can decode it. Also, tokens in a URL often end up in browser history and server logs.