URL Encode / Decode

What URL Encoding Actually Does

URLs are only allowed to contain a limited set of characters: letters, digits, and a handful of symbols. Anything else — spaces, accented letters, ampersands inside a value, emoji — has to be percent-encoded, meaning each disallowed byte is written as a % followed by two hexadecimal digits. This URL encode / decode tool does that conversion both ways, live as you type, and copies the result with one tap. It runs on the browser's own encodeURIComponent, encodeURI, decodeURIComponent, and decodeURI functions, so the output matches exactly what your code, server, or browser would produce.

A Worked Example

Say you are building a search link and the query is q=café & more. If you drop that raw into a URL, the space and the & will break it — the & would be read as the start of a new parameter. Switch the tool to Encode with the Component scope and paste café & more. You get:

caf%C3%A9%20%26%20more

Notice three things: the accented é became %C3%A9 (its two UTF-8 bytes), the spaces became %20, and the & became %26 so it is treated as literal text rather than a separator. You can now safely build https://example.com/search?q=caf%C3%A9%20%26%20more. Paste that whole string back with Decode selected and you recover the original café & more.

Now contrast the scopes. If you instead paste the entire URL https://example.com/search?q=café and choose the Full URL scope, encodeURI keeps the ://, /, ?, and = intact and only escapes the é, giving a still-clickable link. That is the core distinction: Component for a single value, Full URL for a complete address.

When Developers Reach For It

• Debugging APIs. A request fails and the logs show a %-soup string. Paste it into Decode to read what was actually sent.
• Building query strings by hand. When you assemble a link in a template or a shell script, encode each value so reserved characters do not leak into the structure.
• Reading redirect and OAuth URLs. Callback URLs are often double-encoded; decode once, inspect, and decode again if needed.
• Cleaning copied links. Marketing and tracking links arrive bristling with %20 and %2F; decode them to see the real destination.

Handling Malformed Input Gracefully

Decoding is where things break. decodeURIComponent('100%') does not return 100% — it throws a URIError, because % must be followed by two hex digits. Bad escapes like %, %G1, or a truncated %E0% all fail the same way. Rather than letting the page error out, this tool catches the exception and tells you a malformed percent-escape was found, so you can spot the typo and fix it.

Which Characters Get Escaped

It helps to know what each function leaves alone. encodeURIComponent does not escape the unreserved set — letters, digits, and - _ . ! ~ * ' ( ) — but it does escape everything else, including /, ?, #, &, =, +, ,, ;, :, @, $, and the space. encodeURI keeps that same unreserved set plus the reserved structural characters / ? : @ & = + $ , ; # [ ], because those are what hold a URL together. That single difference is why a & inside a value must be encoded with the Component scope: left raw, a server would split your value into two parameters. When you are unsure, default to Component for anything that goes after a ? or =, and reach for Full URL only when you genuinely have a complete address in hand.

Built for Privacy

Everything happens locally in your browser with JavaScript's native URI functions. Your links, tokens, and parameters are never transmitted or saved, which makes the tool safe for production secrets and unpublished endpoints. Once the page has loaded it even works offline.

Pair It With Other Tools

URL work rarely happens alone. When you are formatting slugs and labels, the text case converter normalizes casing before you encode, and the word & character counter helps you keep query strings and parameters within length limits.