URL encoding, also called percent-encoding, rewrites characters that are unsafe or reserved in a web address as a percent sign followed by two hex digits, so data survives a trip through a URL intact. The tool above encodes text to that form or decodes it back, offers both a component and a full-URI mode, and handles UTF-8 so emoji and accents round-trip correctly. Everything runs in your browser, and nothing you paste is transmitted anywhere.
What is URL encoding?
A URL may only contain a limited set of characters. Letters, digits, and a handful of symbols are allowed directly; everything else, from spaces to ampersands to non-Latin scripts, has to be represented indirectly. Percent-encoding does this by converting each unsafe byte into % plus its two-digit hexadecimal value. A space becomes %20, an ampersand becomes %26, and a forward slash becomes %2F. Because the encoders work on UTF-8 bytes, a multi-byte character such as é becomes a sequence of escapes like %C3%A9.
This is what lets you put arbitrary text, including search queries, filenames, and structured values, into a link without breaking it.
Component mode vs full-URI mode
JavaScript, and therefore this tool, offers two encoding functions, and picking the right one matters.
- Component mode (encodeURIComponent) escapes almost everything except unreserved characters. Crucially, it does escape the characters that give a URL its structure:
&,=,?,/,#,:, and more. Use it when you are encoding a single piece of a URL, such as one query-string value, where those characters must be treated as literal data rather than structure. - Full-URI mode (encodeURI) is designed to encode an entire, already-assembled URL. It leaves the structural characters alone so the address remains a working address, and only escapes things that are always unsafe, such as spaces. Use it when you have a complete URL that merely needs cleaning up.
The difference is easiest to see with an example. Take the value dev/tools&more:
| Mode | Result | Why |
|---|---|---|
| Component | dev%2Ftools%26more |
The / and & are escaped so they cannot be mistaken for URL structure. |
| Full URI | dev/tools&more |
The / and & are left intact because a full URL needs them. |
The rule of thumb: if you are building a URL by dropping a value into it, encode that value with component mode. If you are tidying a whole URL, use full-URI mode.
Decoding and malformed input
Decoding is simpler because there is only one direction to go. This tool uses decodeURIComponent, which reverses the output of both encoders since they share the same %XX escape format. Paste an encoded string, and you get the original text back.
Decoding can fail, though, and the most common reason is a stray percent sign. Every % must be followed by exactly two hexadecimal digits. A lone %, or a sequence like %zz or a truncated %2, is not a valid escape, and the decoder reports it as malformed. When that happens, the status line names the position of the problem % so you can correct or remove it rather than hunting through the whole string. This often shows up when a percent sign meant literally, as in “50% off”, was never encoded to %25 in the first place.
Common use cases
- Encoding a search term or other value before dropping it into a query string.
- Making a filename or path segment safe to place in a URL.
- Reading a long, escaped link from a log or an email to see what it actually points to.
- Preparing a value for an API request where reserved characters would otherwise be misread.
- Debugging why a link breaks by decoding it and checking each part.
A note on spaces and the plus sign
You will sometimes see a space written as + rather than %20. That plus-sign convention belongs to one specific format, application/x-www-form-urlencoded, which is how HTML forms package their fields. It is not part of general percent-encoding. This tool follows the standard percent-encoding rules, so a space always becomes %20. Both forms are widely understood by servers, but mixing them up can cause confusion when a literal + in your data is later read as a space.
Encoding is not encryption
Percent-encoding provides no security at all. It has no key and conceals nothing; anyone can decode it in an instant, exactly as this tool does. Its only job is to make text safe to carry inside a URL. If you need to protect a value, use real encryption and never rely on encoding to hide it.
Privacy
Every conversion above happens locally with your browser’s native encoding and decoding functions. There is no server round-trip, no logging, and no third-party analytics on this page, so you can work with links and values you would not want to send elsewhere. Because it runs entirely client-side, you can even load the page and then disconnect from the network to be certain nothing leaves your device.