URL Encode / Decode

How to use the URL Encode / Decode

1. 1

   Pick Encode or Decode, then choose Parameter value for a single query value or Full URL for a complete address.

2. 2

   Paste your text. The result updates as you type, and any malformed % sequence is pointed out by position.

3. 3

   Tick the + option if you are working with HTML form data, where a space is written as +.

4. 4

   Open the URL parser tab and paste a link to see its parts and a table of decoded query parameters.

5. 5

   Edit, add or remove parameters, then copy the rebuilt URL.

Why URLs need encoding at all

A URL can only contain a limited set of ASCII characters, and several of those have a job. The ? starts the query string, & separates parameters, = joins a name to its value and # marks the fragment. If your data contains one of these characters, the browser cannot tell whether it is data or structure.

Imagine a search link for the shop name Ram & Sons. Written raw, ?q=Ram & Sons is read as a parameter q with the value Ram followed by a second, nameless parameter. Encoded, it becomes ?q=Ram%20%26%20Sons and arrives intact. Percent-encoding writes each problem byte as % followed by two hex digits, so & becomes %26 and a space becomes %20.

Characters outside English are first converted to UTF-8 bytes and then each byte is encoded. The rupee sign ₹ is three bytes, so it becomes %E2%82%B9, and नई दिल्ली turns into a long run of %E0%A4 style sequences.

Reserved and unreserved characters (RFC 3986)

The rules come from RFC 3986, the standard that defines URI syntax. It splits characters into groups, and the group decides whether a character may appear as is.

• Unreserved: A to Z, a to z, 0 to 9, and the four symbols - . _ ~. These never need encoding anywhere in a URL.
• Reserved general delimiters: : / ? # [ ] @. They mark the big parts of the URL, such as the scheme, host, path and query.
• Reserved sub-delimiters: ! $ & ' ( ) * + , ; =. They are used inside parts, most famously & and = in query strings.
• Everything else, including spaces, quotes, < >, % itself and all non-ASCII text, must be percent-encoded.

A reserved character only needs encoding when you mean it as data. The / in https://example.in/products is structure and stays; a / inside a parameter value like a date 12/05/2025 should be sent as %2F.

encodeURI vs encodeURIComponent

JavaScript offers two functions and picking the wrong one is the classic bug. This tool exposes both: Parameter value runs encodeURIComponent, and Full URL runs encodeURI.

Use encodeURIComponent for each individual piece you insert into a URL: a search term, a redirect address, a customer name. Use encodeURI only when you have a complete URL that is already structured correctly but contains spaces or Unicode, for example a link to a file called annual report 2025.pdf.

Running encodeURIComponent on a whole URL breaks it, because https:// becomes https%3A%2F%2F. Running encodeURI on a parameter value is just as bad in the other direction: an & inside the value slips through and splits your parameter in two.

%20 or +: which one means space?

Both, depending on where you are. In the path of a URL a space must be %20, and a + is a literal plus sign. In a query string sent by an HTML form, the format called application/x-www-form-urlencoded writes spaces as +. Many server frameworks, and JavaScript's URLSearchParams, follow the form convention and turn + into a space when reading query strings.

This causes real bugs. A phone number like +91 98765 43210 placed in a query string without encoding can reach the server as 91 98765 43210 with a leading space, because the plus was read as a space. Encoding it properly gives %2B91%2098765%2043210, which every server reads correctly. When you decode data captured from a form or an analytics tool, tick Treat + as a space; for anything else, leave it off.

Decoding errors and double encoding

Decoding fails when a % is not followed by two hex digits, for example 50% off typed directly into a link, or when the bytes do not form valid UTF-8, which happens if text was encoded in an old character set or a long sequence was cut halfway. The error message here gives the character position and the exact sequence so you can find it quickly. A literal percent sign must itself be encoded as %25.

Double encoding is the opposite problem. If a value is encoded twice, %20 becomes %2520 and the user sees %20 on screen instead of a space. If your decoded output still contains % sequences, decode it once more and find the step that encoded it twice.

Using the URL parser to clean up links

Long links shared on WhatsApp or copied from ads are often stuffed with tracking parameters such as utm_source, utm_campaign, fbclid and gclid. Paste one into the parser and every parameter appears in its own row, already decoded. Remove the ones you do not need, change a value, or add a new one, and the rebuilt URL updates below with each value encoded using %20 for spaces.

The parser also shows the protocol, host, port (with the default 443 or 80 when none is written), path and hash. It is a quick way to check where a suspicious link really points before you tap it, since the host is the part that decides which website you land on.