URL encoder and decoder
Convert text to percent-encoded form for use in a query string, a path segment or a form body, and decode it back again. Three encoding modes cover the cases that matter: a single value, a whole URL, and application/x-www-form-urlencoded. Unicode is handled as UTF-8, so accents, Arabic, Chinese and emoji survive the round trip.
How to use the URL Encode / Decode
- Choose Encode or Decode.
- Pick the encoding: Component for a single value, Whole URL for a full address, Form body for POST data.
- Paste the text; the result appears as you type.
- Copy the output, or tick "each line separately" to convert a list in one pass.
Why URLs need encoding
A URL may only contain a small set of ASCII characters. Everything else — spaces, accents, quotation marks, any non-Latin script — has to be written as a percent sign followed by two hexadecimal digits representing one UTF-8 byte. A space becomes %20, an ampersand inside a value becomes %26, and "café" becomes caf%C3%A9 because é is two bytes in UTF-8. Skipping this step is how query strings break: a value containing & or = silently splits into extra parameters.
Reserved, unreserved and the three modes
RFC 3986 divides characters into unreserved (always safe) and reserved (structural). Reserved characters must be escaped when they appear inside a value but left alone when they are doing their structural job, which is exactly the difference between the modes below.
| Group | Characters | Escaped by Component | Escaped by Whole URL |
|---|---|---|---|
| Unreserved | A–Z a–z 0–9 - . _ ~ | No | No |
| General delimiters | : / ? # [ ] @ | Yes | No |
| Sub-delimiters | ! $ & ' ( ) * + , ; = | Yes (except !'()* unless strict) | No |
| Everything else | space, quotes, < > { } | \ ^ %, all non-ASCII | Yes | Yes |
Which mode to use
Component is right for a single piece of data: one query-string value, one path segment, one cookie value. Whole URL takes an address that is already assembled and only fixes the illegal characters, leaving the ://, ?, & and # that give the URL its shape. Form body follows the HTML form rules, where a space is written as + rather than %20 and only * - . _ join the alphanumerics as safe.
Strict mode
JavaScript's encodeURIComponent leaves ! ' ( ) * unescaped, which RFC 3986 lists as sub-delimiters. Most servers do not care, but OAuth 1.0 signatures, AWS Signature V4 and some strict parsers do. Ticking strict mode escapes those five characters too.
Decoding
Decoding reverses the process and reports the position of a malformed sequence — a lone % or %2 — instead of failing silently. Note that + only means a space in form encoding; in a path it is a literal plus sign, which is why the mode matters when decoding too. Double-encoded text (%2520) decodes to %20; run it through a second time to get the space.
Frequently asked questions
What is the difference between encodeURI and encodeURIComponent?
encodeURI keeps the characters that give a URL its structure (: / ? # & =) so it can fix a whole address. encodeURIComponent escapes them, which is what you want for a single value inside that address.
Why is a space sometimes %20 and sometimes +?
Percent encoding uses %20. The older application/x-www-form-urlencoded format, used by HTML form submissions, uses + instead. Both appear in the wild, so pick the mode that matches where the text is going.
My text decodes to gibberish — what went wrong?
The bytes were probably not UTF-8 (older systems used Latin-1), or the string was encoded twice. Decode once more if you see %25 sequences.
Is my data sent anywhere?
No. Encoding and decoding both run in your browser; nothing is uploaded.
Privacy
This tool runs entirely inside your browser using WebAssembly and the Canvas/File APIs. Your files are never uploaded to ToolFlint or any third party; you can verify this in your browser's network tab or by switching to airplane mode after the page loads. Read how we process files.
Last updated 2026-09-23.