URL Encoder / Decoder
Escape and unescape URL components instantly. Processed completely in-browser to protect URL payload queries.
URL Escaping Standards
URL encoding (Percent-Encoding) replaces non-ASCII or reserved characters inside URLs with a % followed by their hexadecimal representation. This ensures that parameters containing characters like ?, &, or spaces do not corrupt URL routing logic.
Component Mode (recommended) uses encodeURIComponent, which escapes protocol separators (/, :) so strings can be safely nested as query parameters. Standard Mode uses encodeURI, preserving basic URL syntax.
Introduction
A URL is not just text — it's a structured protocol with strict character rules. Spaces break URLs. Special characters like #, &, =, and ? have reserved meanings in query strings. Unicode characters in non-ASCII domains need percent-encoding to survive transit. The URL Encoder/Decoder handles the complete spectrum: full URL encoding, component encoding (for individual parameters), and decoding with proper handling of UTF-8 multi-byte sequences. Whether you're building query strings, encoding form data, or sanitizing user input for safe URL embedding, this tool ensures your URLs are structurally valid and safely transportable.
What This Tool Does
Why It Matters
URL encoding errors are among the most common causes of broken web functionality. A space in a query parameter value silently truncates the parameter. An unencoded & in a value splits the parameter mid-value. Unencoded # characters start a fragment, hiding everything after them. These bugs are notoriously hard to debug because the encoded URL looks correct at a glance. The 2021 OWASP Top 10 lists injection attacks (including URL injection) as a critical security risk — improper encoding allows attackers to inject additional parameters, modify query strings, or redirect users to malicious sites. Proper URL encoding is both a functionality requirement and a security boundary.
How It Works
Step-by-Step Examples
Enter the text: Hello World & goodbye!
Select URL Encode (component) — encodes spaces as + and special chars as %XX
Click Encode to produce the safe URL parameter value
The output can be appended to a URL query string without breaking the parameter structure
Hello+World+%26+goodbye%21 — spaces become +, & becomes %26, ! becomes %21Paste the encoded URL: https://example.com/search?q=hello+world%26lang%3Dzh
Select URL Decode
Click Decode to reverse the percent-encoding
Observe the decoded URL with readable query parameters
https://example.com/search?q=hello world&lang=zh — fully decoded, readable URLCode Examples
// Component encoding — encodes individual values for query parameters
function encodeComponent(str) {
return encodeURIComponent(str)
.replace(/%20/g, '+')
.replace(/!/g, '%21')
.replace(/'/g, '%27')
.replace(/\(/g, '%28')
.replace(/\)/g, '%29')
.replace(/\*/g, '%2A');
}
function decodeComponent(str) {
return decodeURIComponent(str.replace(/\+/g, ' '));
}
// Full URL encoding — preserves URL structure
function encodeFullURL(url) {
try {
const parsed = new URL(url);
if (parsed.search) {
const params = new URLSearchParams(parsed.search);
for (const [key, value] of params) {
params.set(key, encodeComponent(value));
}
parsed.search = params.toString();
}
return parsed.toString();
} catch {
return encodeComponent(url);
}
}
// Usage
const query = 'search=hello world & lang=zh';
console.log(encodeComponent('hello world & lang=zh'));
// hello+world+%26+lang%3Dzh
console.log(decodeComponent('hello+world+%26+lang%3Dzh'));
// hello world & lang=zhfunction buildQueryString(params) {
return Object.entries(params)
.map(([key, value]) => {
const encodedKey = encodeURIComponent(key);
const encodedValue = encodeURIComponent(String(value))
.replace(/%20/g, '+');
return `${encodedKey}=${encodedValue}`;
})
.join('&');
}
// Usage
const searchParams = {
q: 'machine learning & AI',
lang: 'en',
page: 1,
sort: 'relevance desc'
};
const queryString = buildQueryString(searchParams);
console.log(queryString);
// q=machine+learning+%26+AI&lang=en&page=1&sort=relevance+desc
// Construct full URL
const url = `https://api.example.com/search?${queryString}`;
console.log(url);Reserved URL Characters and Their Meanings
| Character | Name | Reserved In | Must Encode? |
|---|---|---|---|
| $ | Dollar sign | Query strings | Yes — has special meaning in some frameworks |
| & | Ampersand | Query strings | Yes — parameter separator |
| + | Plus sign | Query strings | Yes — represents space in form data |
| = | Equals sign | Query strings | Yes — key-value separator |
| # | Hash/fragment | URL fragment | Yes — starts fragment identifier |
| % | Percent sign | Percent-encoding | Yes — escape character itself |
| / | Slash | URL path | Only in query values |
| ? | Question mark | Query string start | Only in query values |
Encoding Comparison: Full URL vs Component
| Input | URL Encode (component) | URL Encode (full) |
|---|---|---|
| hello world | hello+world | hello%20world |
| a&b=c | a%26b%3Dc | a%26b%3Dc |
| https://x.com | https%3A%2F%2Fx.com | https://x.com |
| 100% | 100%25 | 100%25 |
| 2 + 2 | 2+%2B+2 | 2%20%2B%202 |
Benefits
- Handles UTF-8 multi-byte characters correctly — Chinese, Japanese, Arabic, and emoji encode as proper %XX sequences.
- Supports both component encoding (for query values) and full URL encoding (preserving URL structure).
- Decodes percent-encoded strings back to readable form with proper UTF-8 reassembly.
- Identifies and preserves reserved URL characters when encoding full URLs versus individual components.
Use Cases
Building safe query strings for search APIs that accept user input containing special characters.
Encoding form data for HTTP POST requests where values contain ampersands, equals signs, or spaces.
Sanitizing user-generated content for safe embedding in URL parameters without breaking parameter structure.
Decoding percent-encoded URLs from external sources to extract readable parameter values for logging or analysis.
Common Mistakes to Avoid
Using encodeURI() instead of encodeURIComponent() for query parameter values — encodeURI does not encode &, =, +, or ?.
Double-encoding URLs by applying percent-encoding to already-encoded strings, turning %20 into %2520.
Forgetting to encode the # character in query values — an unencoded # starts a fragment, hiding everything after it.
Using + for spaces in path segments — the + character is only interpreted as a space in query strings, not in URL paths.
Security Implications
Improper URL encoding enables URL injection attacks where adversaries inject additional query parameters, modify existing ones, or redirect users to malicious destinations. OWASP lists URL injection as a critical security risk. Never trust user input in URLs — always encode parameters before embedding them. When decoding URLs, be aware that percent-encoding can hide malicious payloads: %2F is a slash, %00 is a null byte, and %2E%2E is a directory traversal. Always validate decoded URLs before using them in server-side routing or file system operations.
Security Information
Frequently Asked Questions
References & Further Reading
What is URL Encoding?
URL encoding (also called percent encoding) is a mechanism for encoding characters that are not allowed in URLs into a format that can be transmitted over the Internet. Characters like spaces, ampersands, and special symbols must be encoded because they have special meanings in URL structure. URL encoding replaces these characters with a percent sign followed by two hexadecimal digits representing the character's ASCII value.
For example, a space becomes %20, an ampersand becomes %26, and a forward slash becomes %2F. Our encoder handles both URL query parameter encoding and full URL path encoding, with options for component-level encoding.
How URL Encoding and Decoding Works
URL encoding works by converting each unsafe character to its percent-encoded representation. The process uses the character's Unicode code point, converted to hexadecimal. For ASCII characters, this is a straightforward conversion: space (32 in decimal) becomes %20 (32 in hex).
Query String Encoding: Uses encodeURIComponent() which encodes all characters except A-Z a-z 0-9 - _ . ! ~ * ' ( ). This is used for individual parameters in query strings.
URL Path Encoding: Uses encodeURI() which encodes all characters except A-Z a-z 0-9 ; , / ? : @ & = + $ - _ . ! ~ * ' #. This is used for complete URLs where the structure must be preserved.
Double Encoding: A common mistake is encoding a URL that is already encoded, resulting in double-encoded values. For example, encoding "%20" produces "%2520". Always check if data is already encoded before applying encoding.
Where URL Encoding Is Used
Form Submissions: HTML forms use URL encoding to transmit form data to the server. Special characters in form fields are automatically encoded before submission.
API Query Parameters: REST APIs require URL encoding for query parameters containing special characters. User search terms, filter values, and other parameters must be properly encoded.
OAuth Callback URLs: OAuth flows use URL encoding for redirect URIs, authorization codes, and state parameters to ensure they are transmitted safely.
Web Scraping: When constructing URLs programmatically, URL encoding ensures that scraped data, search queries, and other dynamic content is safely embedded in URLs.
URL Encoding Mistakes
Double Encoding: Applying URL encoding twice to the same string produces incorrect results. Encoding "hello world" gives "hello%20world", but encoding again gives "hello%2520world" (with literal %25 instead of %). Always check if data is already encoded.
Not Encoding User Input: Never embed user-provided data directly in URLs without encoding. Attackers can inject malicious characters to perform URL manipulation, open redirect attacks, or server-side request forgery.
Using Wrong Encoding Function: encodeURI() does not encode characters like /, :, &, which are safe in URLs but not in parameters. Use encodeURIComponent() for individual parameter values.
Ignoring Non-ASCII Characters: Non-ASCII characters (like accented letters or Chinese characters) must be encoded as UTF-8 bytes before percent encoding. JavaScript's encoding functions handle this automatically, but manual encoding may miss multi-byte characters.
Related Encoding Tools
Explore these related encoding and data conversion tools:
- Encoding Utilities — Multi-format encoder supporting Base64, URL, Hex, Binary, and more.
- Hash Identifier — Identify hash types by their encoded format.
- SHA-256 Generator — Generate hashes for URL integrity verification.
- Password Generator — Generate passwords that are safe for URL parameters.
- Secret Token Generator — Generate URL-safe tokens for API authentication.