URL Encoder / Decoder
Percent-encode text for URLs, or decode it back. Component, URI, or form-encoded — pick the right mode.
How to use
Pick a direction with the tabs — Encode or Decode. Paste your input on the left. The output appears on the right as you type.
Choose the right encoding mode: Component for a single query value or path segment, URI for a full URL where you want to keep : / ? # & etc. intact, or Form for form-post bodies (spaces become +).
Keyboard shortcuts
Three shortcuts:
| Cmd / Ctrl + K | Focus the input pane |
| Cmd / Ctrl + Enter | Copy output to clipboard |
| Cmd / Ctrl + / | Toggle between Encode and Decode |
When to use it
URL encoding is required whenever text goes into a URL and might contain characters URLs treat specially.
- Building a query string from arbitrary user input.
- Encoding a redirect target passed as a query parameter.
- Escaping a filename or path segment that might contain spaces or special chars.
- Decoding a URL you received in a log or an email —
%20back to space,%3Fback to?.
Options
Component — encodeURIComponent. Escapes everything reserved. Use for a single query value or path segment. This is what you want 90% of the time.
URI — encodeURI. Preserves URL-structural characters (: / ? # [ ] @ ! $ & ' ( ) * + , ; =). Use when the input is a whole URL you want to escape without breaking its structure.
Form — application/x-www-form-urlencoded. Same as Component but spaces become +. Use for form-post bodies.
Format-specific gotchas
Component and URI differ where it matters. Given a=b&c=d, Component escapes & and = (making the whole string one value); URI preserves them. Pick based on what your string represents.
Form uses + for space, not %20. Server-side decoders differ — some (application/x-www-form-urlencoded parsers) accept both; some (path decoders) treat + as a literal plus. Match the encoding mode to the target.
Decode fails on malformed input. A lone % or an incomplete escape like %2 throws a URIError. The tool surfaces the message.
Non-ASCII becomes UTF-8 bytes. é encodes to %C3%A9, not %E9. Legacy Latin-1 systems will misread it.
Privacy
Everything runs in your browser. Your text never leaves the page — no server, no logging, no analytics on the content.