Answer: The URL Encoder / Decoder produces your output instantly from the input you provide — everything runs in your browser, free, with no signup required.
Encode URLs to percent-encoding or decode encoded URLs
URL encoding — percent-encoding — is how arbitrary characters travel inside a URL, a format that only permits a limited set of unreserved ASCII characters. When a space, an ampersand, a Chinese character, or an emoji needs to appear in a query string or path, the safe representation is a percent sign followed by the character's UTF-8 bytes in hexadecimal. A space becomes %20; an ampersand becomes %26 — encoded precisely so it is not mistaken for a parameter separator.
The rules come from the URI specifications (RFC 3986 for URIs generally, with the WHATWG URL standard governing what browsers actually implement). Unreserved characters — letters, digits, hyphen, period, underscore, tilde — may appear raw. Reserved characters like ?, &, =, /, and # have structural meaning, so they must be encoded when used as data. Everything else, including all non-ASCII, is percent-encoded over its UTF-8 bytes.
The classic confusion is component versus full-URI encoding. Encoding a query parameter value must escape & and =, or the server will parse your data as extra parameters; encoding a whole URL must not escape the structural separators. This tool encodes a component (equivalent to encodeURIComponent in JavaScript) and decodes either form, so you can move data in and out of URLs safely.
Practical uses appear constantly in web work: building links that carry a search term, passing an email address or URL inside a redirect parameter, handling user names that contain spaces or accents, and decoding a value that arrives double-encoded. If a plus sign shows up where you expected a space, you are looking at form encoding (application/x-www-form-urlencoded), an older scheme the decoder here also handles.
One more habit worth forming: paste, encode, copy, and paste back — a ten-second loop that has saved countless broken links. Compare the encoded string against the decoded original before shipping; if decoding the encoded value does not reproduce your input exactly, something upstream double-encoded it, and the bug is easier to catch at your desk than in a user's browser.
The table shows the encodings you will encounter most. Note two special cases: the space is %20 in paths but historically + in form-encoded query strings (application/x-www-form-urlencoded), and the plus sign itself must then be encoded as %2B in that context — a mismatch that produces the classic '+ instead of space' bug when decoding with the wrong function.
Non-ASCII characters encode over multiple bytes because UTF-8 uses one byte for ASCII, two for most Latin-script diacritics, and three or four for CJK and emoji. É is %C3%A9, 中 is %E4%B8%AD, and the coffee emoji is four percent triplets. A decoder must therefore decode bytes first, then interpret the byte sequence as UTF-8 — which is exactly what this tool does.
Real-world failures cluster in a few places. Copying a URL out of an email or document can double-encode it (a %20 becomes %2520, because the % itself got encoded), producing a path that literally contains '%20' as text. Building URLs by string concatenation without encoding user input is both a correctness bug and the vector for query-string injection — encode each dynamic piece separately. And API keys or tokens containing + or / must be encoded in query strings, or they arrive corrupted after the server interprets + as space.
| Character | Encoded | Why |
|---|---|---|
| space | %20 | Not allowed raw in URLs |
| & | %26 | Separates query parameters |
| = | %3D | Separates key from value |
| ? | %3F | Starts the query string |
| # | %23 | Starts the fragment |
| + | %2B | Means space in form-encoding |
| % | %25 | Introduces an encoding itself |
| / | %2F | Path separator (encode in values) |
Percent-encoding is not encryption or sanitization. Encoding user input stops it from being parsed as URL structure, but it does not stop XSS or SQL injection by itself — those are defeated by output-encoding for the destination context (HTML, SQL), not by URL encoding. Use this tool to make data survive the trip through a URL; use the appropriate escaping mechanism when that data is later rendered.
What is URL encoding?
A scheme that represents characters not allowed in a URL as a percent sign followed by their UTF-8 hex bytes — a space as %20, an ampersand as %26. Defined by RFC 3986 and the WHATWG URL standard.
What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent escapes every reserved character including &, =, ?, and /, and is correct for query parameter values. encodeURI leaves structural characters intact and is meant for a complete URL.
Why does a space sometimes appear as + instead of %20?
In application/x-www-form-urlencoded data (HTML form submissions), spaces are encoded as +. Elsewhere in URLs the correct encoding is %20. Decoders must know which convention the sender used, or + and space get confused.
What does double encoding look like and how do I fix it?
A %20 that gets encoded again becomes %2520 (the % becomes %25). If a URL shows percent codes in the final rendered text, it was double-encoded — decode once and re-encode only the components that need it.
Is URL encoding a security measure?
No. It transports characters safely through URL syntax but is neither encryption nor sanitization. Prevent XSS or SQL injection by escaping data for the destination context, not by URL encoding.