URL Encoder & Decoder
Percent-encode URLs and query parameters, or decode encoded strings back to plain text. Supports both full URL encoding (encodeURI) and component encoding (encodeURIComponent). Free, instant, runs entirely in your browser.
// how to use
Four steps to encode or decode any URL or string.
Select mode
Choose Encode to convert plain text to percent-encoded format, or Decode to reverse the process.
Paste input
Paste your URL, query parameter, or percent-encoded string into the input area. Results update live as you type.
Choose encoding type
Select encodeURIComponent for query values and path segments, or encodeURI to encode a full URL while keeping structural characters.
Copy output
Click Copy to copy the encoded or decoded result to your clipboard and paste it wherever you need it.
// code examples
URL encoding in JavaScript, Python, PHP, Go, and Bash.
// Encode a URL component (query value, path segment)
const query = "hello world & more";
const encoded = encodeURIComponent(query);
// "hello%20world%20%26%20more"
// Encode a full URL (preserves ://?#& etc.)
const url = "https://example.com/path?q=hello world";
const safeUrl = encodeURI(url);
// "https://example.com/path?q=hello%20world"
// Decode a percent-encoded string
const raw = "hello%20world%20%26%20more";
const decoded = decodeURIComponent(raw);
// "hello world & more"
from urllib.parse import quote, unquote, quote_plus, unquote_plus
# Encode a URL component (RFC 3986 — safe chars are unreserved)
query = "hello world & more"
encoded = quote(query, safe="")
# "hello%20world%20%26%20more"
# Encode a full URL (preserve ://?#& etc.)
url = "https://example.com/path?q=hello world"
safe_url = quote(url, safe=":/?#[]@!$&'()*+,;=")
# "https://example.com/path?q=hello%20world"
# Decode
decoded = unquote("hello%20world%20%26%20more")
# "hello world & more"
// Encode a URL component (spaces → %20)
$query = "hello world & more";
$encoded = rawurlencode($query);
// "hello%20world%20%26%20more"
// Encode for HTML form submission (spaces → +)
$form_encoded = urlencode($query);
// "hello+world+%26+more"
// Decode rawurl-encoded string
$decoded = rawurldecode("hello%20world%20%26%20more");
// "hello world & more"
// Decode form-encoded string
$form_decoded = urldecode("hello+world+%26+more");
// "hello world & more"
import (
"fmt"
"net/url"
)
func main() {
// Encode a query parameter value (spaces → +)
encoded := url.QueryEscape("hello world & more")
fmt.Println(encoded)
// "hello+world+%26+more"
// Decode a query-escaped string
decoded, err := url.QueryUnescape(encoded)
if err == nil {
fmt.Println(decoded)
// "hello world & more"
}
// PathEscape uses %20 (not +) for spaces
pathSafe := url.PathEscape("hello world & more")
fmt.Println(pathSafe)
// "hello%20world%20&%20more"
}
# Encode using Python (available on most Unix systems)
python3 -c "import urllib.parse; print(urllib.parse.quote('hello world & more', safe=''))"
# hello%20world%20%26%20more
# Decode using Python
python3 -c "import urllib.parse; print(urllib.parse.unquote('hello%20world%20%26%20more'))"
# hello world & more
# Encode using curl's --data-urlencode (write to /dev/null)
curl -Gs "https://httpbin.org/get" --data-urlencode "q=hello world & more" -o /dev/null -w "%{url_effective}\n"
# Using Node.js from CLI
node -e "console.log(encodeURIComponent('hello world & more'))"
# hello%20world%20%26%20more
What is URL encoding?
URL encoding, formally defined in RFC 3986, is a method of representing arbitrary data within a Uniform Resource Identifier (URI) using only the limited set of characters that are safe for transmission in a URL. When a character is not allowed or has special meaning in a URL, it is replaced with a percent sign followed by two uppercase hexadecimal digits representing the character's UTF-8 byte value. For example, a space character (ASCII 32, hex 0x20) becomes %20.
Why is it needed? URLs can only be sent over the internet using characters from the ASCII character set, and even then, many ASCII characters — such as spaces, ampersands, equals signs, and hash symbols — carry structural meaning within a URL. Without encoding, a query parameter value containing an & would be mistaken for a parameter separator, corrupting the URL's meaning. Encoding ensures that data is transmitted exactly as intended.
encodeURI vs encodeURIComponent: JavaScript provides two built-in functions for URL encoding. encodeURI() is designed to encode a complete URL — it leaves intact all characters that are valid and structural within a URL, including : / ? # [ ] @ ! $ & ' ( ) * + , ; =. encodeURIComponent() is designed to encode a single URL component such as a query parameter value or a path segment — it encodes everything except the unreserved characters defined in RFC 3986: letters (A–Z, a–z), digits (0–9), and - _ . ! ~ * ' ( ). As a rule, use encodeURIComponent() for any user-supplied value you embed in a URL.
Common characters that must be encoded:
- Space →
%20 - & (ampersand) →
%26— separates query parameters - = (equals) →
%3D— separates key from value in query strings - + (plus) →
%2B— has special meaning in form encoding - # (hash) →
%23— denotes fragment identifiers - % (percent) →
%25— the encoding delimiter itself - / (slash) →
%2F— path separator - ? (question mark) →
%3F— query string delimiter
// faq
Common questions about URL encoding and percent encoding.
What is URL encoding (percent encoding)?
URL encoding, also called percent encoding, is a method of encoding special or non-ASCII characters in a URL by replacing each byte of the character with a % sign followed by two hexadecimal digits. For example, a space becomes %20 and an ampersand becomes %26. It is standardized in RFC 3986 and is required because URLs may only contain a restricted set of ASCII characters.
What is the difference between encodeURI and encodeURIComponent?
encodeURI() encodes a complete URL and preserves characters that are structurally meaningful in a URL — such as :, /, ?, #, &, and =. encodeURIComponent() encodes a URL component (a single value) and encodes all characters except letters, digits, and the unreserved characters - _ . ! ~ * ' ( ). Use encodeURIComponent() when embedding dynamic values into query parameters or path segments.
Why are spaces encoded as %20 or +?
%20 is the correct RFC 3986 percent-encoding of a space (ASCII 32). The + convention for spaces comes from HTML form encoding (application/x-www-form-urlencoded), where it was used as a shorthand. When reading query strings from HTML form submissions, servers must decode + as a space. In all other contexts — path segments, headers, JSON — %20 is the correct and unambiguous representation.
When do I need to URL encode my data?
You need URL encoding whenever you insert dynamic or user-supplied data into a URL. Common cases include: building query strings from form inputs, constructing API request URLs with search terms, embedding file paths in URL parameters, and generating links that contain special characters. Failing to encode can cause broken requests, misparsed parameters, or open redirect vulnerabilities.
Is URL encoding the same as URL encryption?
No. URL encoding is a formatting technique — it just represents characters in a URL-safe form. It provides no confidentiality or security whatsoever. Anyone can decode a percent-encoded string instantly. URL encryption refers to protecting the data in transit using HTTPS (TLS). Never put sensitive information in a URL and assume it is protected by encoding alone.
// more tools
Other free browser-based developer utilities.
Base64 Encoder / Decoder
Encode strings and binary data to Base64 and decode back. RFC 4648 compliant.
Open →HTML Entity Encoder
Encode special characters to HTML entities for XSS prevention.
Open →JSON Formatter
Beautify, minify, and validate JSON with syntax error highlighting.
Open →Password Generator
Generate cryptographically secure random passwords of any length.
Open →Epoch Converter
Convert Unix timestamps to readable dates and back, with code examples.
Open →