Skip to content
koducathome

URL Encoder & Decoder

Percent-encode text for URLs or decode encoded strings, choosing between component and full-URL encoding.

How to use this tool

Steps for using the URL Encoder.

  1. Choose Encode or Decode. The result updates as you type; Sample loads an example.
  2. Pick the encoding rules: Component (encodeURIComponent) for a single query value or path segment, or Full URL (encodeURI) to escape a whole address while keeping :/?#&= intact.
  3. When decoding form data or query strings produced by HTML forms, tick Treat + as space.
  4. Tick Process each line separately to convert a list of values in one go while keeping the line breaks.
  5. If decoding fails, read the error: it names the malformed sequence and where it is, instead of a generic URIError.

Example

Encode a query value (component mode)

Text
café crème & co
Encoded
caf%C3%A9%20cr%C3%A8me%20%26%20co

Common use cases

  • Encoding search terms, redirect URLs and other values before adding them to a query string.
  • Decoding utm_ parameters, OAuth redirect_uri values or log entries to see what they contain.
  • Debugging double-encoded URLs where %2520 appears instead of %20.
  • Encoding a list of path segments or file names line by line.
  • Finding the broken escape that makes decodeURIComponent throw in production.

How percent-encoding works

URLs may only contain a limited set of ASCII characters, and several of those — ?, &, =, /, # — have structural meaning. Percent-encoding (RFC 3986) replaces any other character with % followed by two hexadecimal digits for each of its bytes. Non-ASCII text is first converted to UTF-8, so é becomes the two bytes C3 A9 and is written %C3%A9, and an emoji becomes four escapes.

JavaScript offers two encoders, and choosing the wrong one is a classic bug. encodeURIComponent escapes everything except letters, digits and -_.!~*'(), which makes it right for a single value you are inserting into a URL: a search term containing & must become %26 or it would start a new parameter. encodeURI leaves the reserved characters alone so a complete URL keeps working — but that means it will not protect a value that contains & or #. Decoding mirrors this: in Full URL mode, escapes for reserved characters such as %2F and %26 are kept, exactly as decodeURI does.

HTML forms submitted as application/x-www-form-urlencoded encode spaces as + rather than %20. A plain decodeURIComponent leaves those plus signs in place, so query strings copied from form submissions come out as café+crème. The Treat + as space option converts them first; a literal plus sign in form data is always sent as %2B, so the conversion is safe.

The browser's decodeURIComponent throws an unhelpful URIError: URI malformed on the first bad sequence. This decoder reads each run of escapes as UTF-8 bytes and reports precisely what is wrong: a % not followed by two hex digits, a byte that cannot start a UTF-8 character such as %FF, an incomplete multi-byte sequence, or an overlong encoding. Encoding likewise reports unpaired surrogates — half an emoji, usually from text cut at the wrong place — instead of crashing.

Limitations

  • Encoding always uses UTF-8; legacy encodings such as Windows-1252 percent-escapes are reported as malformed UTF-8.
  • Component mode follows encodeURIComponent exactly, so !'()* are left unescaped; some strict RFC 3986 contexts require them to be escaped.
  • The tool does not split a URL into its parts — use the URL Parser or Query String Parser for that.
  • Input is limited to 2 million characters.

Frequently asked questions

Should I use encodeURI or encodeURIComponent?

Use encodeURIComponent (Component mode) for anything you insert into a URL — a query value, a path segment, a redirect target. Use encodeURI (Full URL mode) only when you have a complete URL that merely contains spaces or non-ASCII characters.

Why is a space sometimes %20 and sometimes +?

%20 is the standard percent-encoding used everywhere in a URL. + is a convention of HTML form encoding (application/x-www-form-urlencoded) and only means a space in query strings and form bodies. Use the Treat + as space option when decoding those.

What does "Incomplete UTF-8 sequence" mean?

The escapes start a multi-byte character but stop too early — for example %E0%A4 begins a three-byte character but the third byte is missing. This usually happens when a URL was truncated or edited by hand.

Is URL encoding the same as Base64?

No. Percent-encoding escapes only the characters that are unsafe in a URL and keeps the rest readable. Base64 re-encodes all bytes and is used for binary data, not for building URLs.

Is my text sent to a server?

No. Encoding and decoding run entirely in your browser.