URL Encoder/Decoder
encodeURIComponent — encodes everything except letters, digits, and -_.!~*'()
Input
Output

Related Tools

See all ->
Base64 Encoder/DecoderEncode & decode instantlyHash GeneratorMD5 · SHA-256 · SHA-512JWT DecoderDecode & verify tokensPassword GeneratorSecure & entropy-scoredRegex TesterTest & debug patternsJSON FormatterFormat & validateMeta Tag GeneratorSEO · OG · Twitter · JSON-LDDiff CheckerCompare text & code

URL Encode & Decode Online Free — Percent-Encode Query Strings & Decode %XX URLs

Updated May 14, 2026
Share & Support

What's included

Features

Live URL encoding and decoding — output updates instantly as you type with no button click needed
Query String mode using encodeURIComponent — encodes all URL-reserved characters including / : ? & # = +
Full URL mode using encodeURI — preserves URL structure characters while encoding unsafe characters
Highlighted %XX sequences in encoded output — cyan highlights show exactly which characters were encoded
Highlighted percent sequences in decode input — see which sequences will be decoded before conversion
Swap button — flip output back to input and switch encode/decode mode automatically in one click
Stats bar — count of encoded or decoded sequences and byte size change between input and output
100% client-side — uses native browser JavaScript (encodeURIComponent, decodeURIComponent), nothing uploaded; encode binary data differently with our Base64 Encoder / Decoder

About this tool

Encode and Decode URLs Online — %XX Percent-Encoding in Your Browser

Runs in your browser
No install or signup
Free forever

You have a URL with spaces, ampersands, equals signs, or special characters and you need to encode it for safe use in a query string. Or you got a URL from a log file or API response full of %20 and %26 sequences and you need to read what it actually says. Paste it here and get the result instantly.

URLs can only contain a specific set of safe characters — letters, digits, and a handful of punctuation marks. Characters outside that set — spaces, &, =, ?, #, /, and all non-ASCII characters like accented letters, emoji, and CJK characters — must be replaced with %XX sequences (percent-encoding) before they can be safely transmitted in a URL. A space becomes %20, an ampersand becomes %26, the euro sign € becomes %E2%82%AC.

Which mode do you need?

Query String mode uses encodeURIComponent, which encodes everything including URL structural characters like / : ? & = # +. Use this when encoding a value that will appear inside a query parameter — for example, a redirect URL, a search term, a JSON snippet, or any user-provided input. This prevents the value's special characters from breaking the URL's structure.

Full URL mode uses encodeURI, which preserves URL structural characters so the URL's path, query, and fragment stay intact. Use this when encoding a complete URL that contains spaces or international characters but needs to remain a valid URL.

Decoding is the reverse: paste any percent-encoded URL or string and the %XX sequences are converted back to their original characters — including multi-byte UTF-8 sequences for international characters.

Every encoded sequence is highlighted in cyan in the output so you can see exactly which characters were changed. Everything runs in your browser — no server, no sign-up, no data sent anywhere.

Step by step

How to Use

  1. 1
    Choose Encode or Decode modeUse the Encode / Decode toggle at the top of the tool to select which direction to convert. Encode turns plain text into %XX percent-encoded sequences. Decode turns a percent-encoded URL or query string back into readable text.
  2. 2
    Select the encoding mode (Encode only)Choose Query String mode (encodeURIComponent) when encoding an individual query parameter value — it encodes everything including :, /, ?, &, =, #, and +, preventing them from being misinterpreted as URL structure. Choose Full URL mode (encodeURI) when encoding a complete URL that has spaces or non-ASCII characters but needs its structural characters (slashes, question marks, ampersands) to remain intact.
  3. 3
    Paste your text or URL into the input paneType or paste any text, URL, or query string value into the input panel on the left. The percent-encoded (or decoded) output appears immediately on the right as you type — no button press needed. Each %XX sequence in the output is highlighted in cyan so you can see exactly which characters were converted.
  4. 4
    Read the stats and copy the outputThe stats bar below the output shows the number of sequences encoded or decoded and the byte size change between input and output — useful for understanding URL length overhead. Click Copy to copy the full output to your clipboard. If the input contains a malformed sequence (a lone % not followed by two hex digits), a clear error message appears instead of silently corrupting the output.
  5. 5
    Swap for round-trip verificationClick the ⇄ swap button to instantly move the output back to the input and switch between Encode and Decode mode. This is the fastest way to verify round-trip accuracy — encode something, then swap and decode the result to confirm you get the original text back. Useful when debugging encoding mismatches in API requests or redirect URL chains.

Real-world uses

Common Use Cases

🔗
Encode user input before appending it to a URL
Encode search terms, filter values, email addresses, and any user-provided text with Query String mode (encodeURIComponent) so characters like &, =, +, /, and ? are encoded as literal data rather than being misinterpreted as URL syntax by browsers and servers.
🔀
Fix a broken redirect URL passed as a query parameter
A redirect URL like /login?redirect=/dashboard?user=123&token=abc will confuse the outer URL parser. Encode the redirect value with encodeURIComponent — its /, ?, & become %2F, %3F, %26 — making it a single opaque parameter the server can decode intact.
📋
Build API request URLs with dynamic values
Encode dates, emails, JSON fragments, and search queries with encodeURIComponent before appending them to API request URLs. Prevents malformed requests, injection issues, and 400 errors caused by unencoded special characters in parameter values. Format the JSON payload with our JSON Formatter first.
🌍
Encode accented letters and emoji for internationalized URLs
Non-ASCII characters — é, ü, ñ, CJK characters, Arabic, Hebrew, emoji — must be UTF-8 percent-encoded to work correctly across all browsers, servers, and HTTP clients. Paste the character and get the correct %XX sequence immediately.
🐛
Read a percent-encoded URL from a log or DevTools network request
Decode %20, %26, %3D and other sequences from server logs, redirect chains, API headers, and browser DevTools requests back to readable text. The encoded sequences are highlighted in the input so you can see exactly which parts were encoded. Decode JWT tokens in those requests with our JWT Decoder.
📄
Debug a form submission encoding mismatch (%20 vs +)
HTML forms use application/x-www-form-urlencoded format (+ for spaces), while encodeURIComponent uses %20. If a server decoder expects one and receives the other, the value appears corrupted. Test and compare both encoding formats here before debugging further.

Got questions?

Frequently Asked Questions

Select Encode mode and choose Query String (encodeURIComponent). Paste the value — just the query parameter value, not the full URL — and the encoded output appears instantly. encodeURIComponent encodes everything including & = ? / : # +, so characters that would otherwise be misinterpreted as URL structure become safe %XX sequences. For example, the string "[email protected]&ref=home" becomes "user%40example.com%26ref%3Dhome" — safely passable as a single parameter value.

Select Decode mode, paste the percent-encoded URL or query string, and the decoded text appears on the right instantly. %20 becomes a space, %26 becomes &, %3D becomes =. The decoder also handles multi-byte UTF-8 sequences for international characters — %C3%A9 decodes to é, %E2%82%AC decodes to €. Malformed sequences (an incomplete %XX code) show a clear error instead of corrupting the output.

Use encodeURIComponent (Query String mode) for encoding individual query parameter values — search terms, email addresses, redirect URLs, JSON snippets, any user input. It encodes everything including URL structural characters like / : ? & # = so they're treated as literal data. Use encodeURI (Full URL mode) when encoding a complete URL that has spaces or accented characters but needs to remain a valid URL with its structure intact — it preserves / : ? & # =. When in doubt, use encodeURIComponent — it's the safer choice for values.

If your redirect URL contains characters like /, ?, &, or =, and you include it in another URL without encoding, the outer URL parser will misinterpret those characters as URL structure. For example, redirect=/dashboard?user=123&token=abc will make the server think "token=abc" is a separate parameter, not part of the redirect URL. Encode the redirect value with encodeURIComponent first — the /, ?, &, and = become %2F, %3F, %26, and %3D, making the entire redirect URL a single opaque parameter value.

%20 and + both represent a space, but in different contexts. %20 is standard RFC 3986 percent-encoding — correct for all URL contexts. The + sign represents a space only in application/x-www-form-urlencoded format, which is used when an HTML form submits via POST with the default Content-Type. JavaScript's encodeURIComponent always uses %20. If a server-side decoder using + fails to decode a %20 space (or vice versa), that's an encoding format mismatch.

No — they solve different problems. URL encoding replaces individual unsafe characters with %XX sequences and the output still looks recognizable (e.g., "hello world" becomes "hello%20world"). Base64 encoding converts all bytes into a 64-character alphabet and the output looks completely different from the input (e.g., "hello" becomes "aGVsbG8="). Use URL encoding to make text safe in URLs. Use Base64 to embed binary data in text channels like JSON or email headers.

Yes — 100% private. Encoding and decoding use the browser's native JavaScript functions (encodeURIComponent, encodeURI, decodeURIComponent). Nothing is sent to any server. Safe for authentication tokens, session parameters, redirect URLs, and any sensitive query string values you wouldn't want to transmit to a third-party service.

Letters (A–Z, a–z), digits (0–9), and four unreserved characters: hyphen (-), underscore (_), period (.), and tilde (~). Everything else — spaces, &, =, ?, #, /, +, :, brackets, non-ASCII characters, emoji, and accented letters — must be percent-encoded when included in a URL.