URL encoder and decoder online

How percent-encoding works

A URL may only contain a small set of characters: the unreserved ones (letters, digits, hyphen, full stop, underscore and tilde) and a handful of reserved ones that carry structure. Anything else has to be written as a percent sign followed by the two hexadecimal digits of its byte value. A space becomes %20 because a space is byte 0x20. The rule works on bytes rather than characters, so anything outside ASCII is turned into UTF-8 first and then escaped one byte at a time — ä is two bytes, so it becomes %C3%A4, and an emoji is four bytes and four escapes.

The awkward part is that some characters are legal in a URL but only in certain positions. A slash is correct between path segments and disastrous inside a filename. An ampersand is correct between query parameters and disastrous inside a value. That is exactly what the two modes above choose between. Encode whole URL leaves : / ? & = # intact — it is JavaScript's encodeURI, and it is what you want when tidying an address that already exists. Encode value inside URL escapes those characters too — it is encodeURIComponent, and it is what you want for one parameter value before you drop it into a URL you are assembling.

Decoding is where scripts usually fall over, because decodeURIComponent throws a URIError at the first escape it cannot read and returns nothing at all, however much of the string was fine. This page inspects the text before decoding it, so a broken escape produces a message naming the position of the offending percent sign instead of an empty box.

If what you paste contains a query string, the table above splits it into decoded pairs using the browser's own URLSearchParams. That follows form-encoding rules, so repeated names each get their own row, a name with no value shows as empty, and a plus sign is read as a space regardless of the checkbox — the checkbox governs the free-text decode in the result box, not the table.

Questions about URL encoding

Should I encode the whole URL or only one value?

Encode the value, almost always. The whole-URL mode is a repair tool: it fixes an address that has spaces or accented characters in it while leaving the scheme, host, path separators and parameter separators working. It cannot help you build a URL safely, because a value containing an ampersand or an equals sign will pass through untouched and silently split into extra parameters at the other end. Build addresses by encoding each value on its own and joining them with the separators yourself. That is the difference between a search box that handles the query a=1&b=2 correctly and one that does not.

Why is a space sometimes %20 and sometimes a plus?

Two standards overlap here. Percent-encoding, defined in RFC 3986, has one answer: a space is %20, everywhere in a URL. HTML form submission uses an older variant called application/x-www-form-urlencoded, in which a space is a plus sign and a literal plus is written %2B. Browsers still submit forms that way, so query strings in the wild use both conventions and you cannot tell from the text alone which one produced a given plus. That is why decoding here has a checkbox rather than a guess: tick it for anything that came out of a form or a search box, leave it clear for a path segment or an API parameter.

Which characters actually have to be encoded?

Only the unreserved set is always safe: A–Z, a–z, 0–9 and - . _ ~. The reserved characters : / ? # [ ] @ ! $ & ' ( ) * + , ; = are legal but meaningful, so they must be escaped whenever they appear inside a value rather than as structure. Everything else — spaces, quotation marks, angle brackets, backslashes, control characters, anything non-ASCII — has to be escaped everywhere. JavaScript's two functions are slightly more relaxed than the specification and leave ! ' ( ) * alone, which is harmless in practice but worth knowing if you are comparing output against another language's library.

Why is my link suddenly full of %25?

Because it was encoded twice. %25 is the escape for a literal percent sign, so encoding %20 a second time produces %2520, and the receiving end decodes it once to %20 and shows a literal percent-two-zero instead of a space. Encode three times and you get %252520. It usually happens when a value is escaped in application code and then escaped again by a template or an HTTP client that assumed it was raw. The status line here warns you when the text you are about to encode already contains percent escapes, which is the cheapest way to catch it.

How do non-English characters work in a URL?

Path and query parts are converted to UTF-8 and percent-escaped, which is why a Cyrillic or Chinese address looks long once encoded and short again in the address bar — browsers display the decoded form while sending the encoded one. Domain names are different: they use Punycode, a separate scheme that turns münchen.de into xn--mnchen-3ya.de. Neither of the buttons here touches the host part, so if you need to convert an internationalised domain, that is a different job. Anything after the first slash is fair game for this tool.