GeneratePass
LOCAL URL CONVERTER

URL Encoder / Decoder

Escape and unescape URL components instantly. Processed completely in-browser to protect URL payload queries.

Technical Specs

URL Escaping Standards

URL encoding (Percent-Encoding) replaces non-ASCII or reserved characters inside URLs with a % followed by their hexadecimal representation. This ensures that parameters containing characters like ?, &, or spaces do not corrupt URL routing logic.

Component Mode (recommended) uses encodeURIComponent, which escapes protocol separators (/, :) so strings can be safely nested as query parameters. Standard Mode uses encodeURI, preserving basic URL syntax.

Introduction

A URL is not just text — it's a structured protocol with strict character rules. Spaces break URLs. Special characters like #, &, =, and ? have reserved meanings in query strings. Unicode characters in non-ASCII domains need percent-encoding to survive transit. The URL Encoder/Decoder handles the complete spectrum: full URL encoding, component encoding (for individual parameters), and decoding with proper handling of UTF-8 multi-byte sequences. Whether you're building query strings, encoding form data, or sanitizing user input for safe URL embedding, this tool ensures your URLs are structurally valid and safely transportable.

What This Tool Does

Why It Matters

URL encoding errors are among the most common causes of broken web functionality. A space in a query parameter value silently truncates the parameter. An unencoded & in a value splits the parameter mid-value. Unencoded # characters start a fragment, hiding everything after them. These bugs are notoriously hard to debug because the encoded URL looks correct at a glance. The 2021 OWASP Top 10 lists injection attacks (including URL injection) as a critical security risk — improper encoding allows attackers to inject additional parameters, modify query strings, or redirect users to malicious sites. Proper URL encoding is both a functionality requirement and a security boundary.

How It Works

Step-by-Step Examples

Example 1: Encode a search query for a URL parameter
1

Enter the text: Hello World & goodbye!

2

Select URL Encode (component) — encodes spaces as + and special chars as %XX

3

Click Encode to produce the safe URL parameter value

4

The output can be appended to a URL query string without breaking the parameter structure

ResultHello+World+%26+goodbye%21 — spaces become +, & becomes %26, ! becomes %21
Example 2: Decode a percent-encoded URL to readable form
1

Paste the encoded URL: https://example.com/search?q=hello+world%26lang%3Dzh

2

Select URL Decode

3

Click Decode to reverse the percent-encoding

4

Observe the decoded URL with readable query parameters

Resulthttps://example.com/search?q=hello world&lang=zh — fully decoded, readable URL

Code Examples

javascriptURL encode and decode components and full URLs
// Component encoding — encodes individual values for query parameters
function encodeComponent(str) {
  return encodeURIComponent(str)
    .replace(/%20/g, '+')
    .replace(/!/g, '%21')
    .replace(/'/g, '%27')
    .replace(/\(/g, '%28')
    .replace(/\)/g, '%29')
    .replace(/\*/g, '%2A');
}

function decodeComponent(str) {
  return decodeURIComponent(str.replace(/\+/g, ' '));
}

// Full URL encoding — preserves URL structure
function encodeFullURL(url) {
  try {
    const parsed = new URL(url);
    if (parsed.search) {
      const params = new URLSearchParams(parsed.search);
      for (const [key, value] of params) {
        params.set(key, encodeComponent(value));
      }
      parsed.search = params.toString();
    }
    return parsed.toString();
  } catch {
    return encodeComponent(url);
  }
}

// Usage
const query = 'search=hello world & lang=zh';
console.log(encodeComponent('hello world & lang=zh'));
// hello+world+%26+lang%3Dzh

console.log(decodeComponent('hello+world+%26+lang%3Dzh'));
// hello world & lang=zh
javascriptBuild a safe query string from an object
function buildQueryString(params) {
  return Object.entries(params)
    .map(([key, value]) => {
      const encodedKey = encodeURIComponent(key);
      const encodedValue = encodeURIComponent(String(value))
        .replace(/%20/g, '+');
      return `${encodedKey}=${encodedValue}`;
    })
    .join('&');
}

// Usage
const searchParams = {
  q: 'machine learning & AI',
  lang: 'en',
  page: 1,
  sort: 'relevance desc'
};

const queryString = buildQueryString(searchParams);
console.log(queryString);
// q=machine+learning+%26+AI&lang=en&page=1&sort=relevance+desc

// Construct full URL
const url = `https://api.example.com/search?${queryString}`;
console.log(url);

Reserved URL Characters and Their Meanings

CharacterNameReserved InMust Encode?
$Dollar signQuery stringsYes — has special meaning in some frameworks
&AmpersandQuery stringsYes — parameter separator
+Plus signQuery stringsYes — represents space in form data
=Equals signQuery stringsYes — key-value separator
#Hash/fragmentURL fragmentYes — starts fragment identifier
%Percent signPercent-encodingYes — escape character itself
/SlashURL pathOnly in query values
?Question markQuery string startOnly in query values

Encoding Comparison: Full URL vs Component

InputURL Encode (component)URL Encode (full)
hello worldhello+worldhello%20world
a&b=ca%26b%3Dca%26b%3Dc
https://x.comhttps%3A%2F%2Fx.comhttps://x.com
100%100%25100%25
2 + 22+%2B+22%20%2B%202

Benefits

  • Handles UTF-8 multi-byte characters correctly — Chinese, Japanese, Arabic, and emoji encode as proper %XX sequences.
  • Supports both component encoding (for query values) and full URL encoding (preserving URL structure).
  • Decodes percent-encoded strings back to readable form with proper UTF-8 reassembly.
  • Identifies and preserves reserved URL characters when encoding full URLs versus individual components.

Use Cases

01

Building safe query strings for search APIs that accept user input containing special characters.

02

Encoding form data for HTTP POST requests where values contain ampersands, equals signs, or spaces.

03

Sanitizing user-generated content for safe embedding in URL parameters without breaking parameter structure.

04

Decoding percent-encoded URLs from external sources to extract readable parameter values for logging or analysis.

Common Mistakes to Avoid

Using encodeURI() instead of encodeURIComponent() for query parameter values — encodeURI does not encode &, =, +, or ?.

Double-encoding URLs by applying percent-encoding to already-encoded strings, turning %20 into %2520.

Forgetting to encode the # character in query values — an unencoded # starts a fragment, hiding everything after it.

Using + for spaces in path segments — the + character is only interpreted as a space in query strings, not in URL paths.

Security Implications

Improper URL encoding enables URL injection attacks where adversaries inject additional query parameters, modify existing ones, or redirect users to malicious destinations. OWASP lists URL injection as a critical security risk. Never trust user input in URLs — always encode parameters before embedding them. When decoding URLs, be aware that percent-encoding can hide malicious payloads: %2F is a slash, %00 is a null byte, and %2E%2E is a directory traversal. Always validate decoded URLs before using them in server-side routing or file system operations.

Security Information

Frequently Asked Questions

Fundamentals

What is URL Encoding?

URL encoding (also called percent encoding) is a mechanism for encoding characters that are not allowed in URLs into a format that can be transmitted over the Internet. Characters like spaces, ampersands, and special symbols must be encoded because they have special meanings in URL structure. URL encoding replaces these characters with a percent sign followed by two hexadecimal digits representing the character's ASCII value.

For example, a space becomes %20, an ampersand becomes %26, and a forward slash becomes %2F. Our encoder handles both URL query parameter encoding and full URL path encoding, with options for component-level encoding.

Technical Deep Dive

How URL Encoding and Decoding Works

URL encoding works by converting each unsafe character to its percent-encoded representation. The process uses the character's Unicode code point, converted to hexadecimal. For ASCII characters, this is a straightforward conversion: space (32 in decimal) becomes %20 (32 in hex).

Query String Encoding: Uses encodeURIComponent() which encodes all characters except A-Z a-z 0-9 - _ . ! ~ * ' ( ). This is used for individual parameters in query strings.

URL Path Encoding: Uses encodeURI() which encodes all characters except A-Z a-z 0-9 ; , / ? : @ & = + $ - _ . ! ~ * ' #. This is used for complete URLs where the structure must be preserved.

Double Encoding: A common mistake is encoding a URL that is already encoded, resulting in double-encoded values. For example, encoding "%20" produces "%2520". Always check if data is already encoded before applying encoding.

Practical Applications

Where URL Encoding Is Used

Form Submissions: HTML forms use URL encoding to transmit form data to the server. Special characters in form fields are automatically encoded before submission.

API Query Parameters: REST APIs require URL encoding for query parameters containing special characters. User search terms, filter values, and other parameters must be properly encoded.

OAuth Callback URLs: OAuth flows use URL encoding for redirect URIs, authorization codes, and state parameters to ensure they are transmitted safely.

Web Scraping: When constructing URLs programmatically, URL encoding ensures that scraped data, search queries, and other dynamic content is safely embedded in URLs.

Security Pitfalls

URL Encoding Mistakes

Double Encoding: Applying URL encoding twice to the same string produces incorrect results. Encoding "hello world" gives "hello%20world", but encoding again gives "hello%2520world" (with literal %25 instead of %). Always check if data is already encoded.

Not Encoding User Input: Never embed user-provided data directly in URLs without encoding. Attackers can inject malicious characters to perform URL manipulation, open redirect attacks, or server-side request forgery.

Using Wrong Encoding Function: encodeURI() does not encode characters like /, :, &, which are safe in URLs but not in parameters. Use encodeURIComponent() for individual parameter values.

Ignoring Non-ASCII Characters: Non-ASCII characters (like accented letters or Chinese characters) must be encoded as UTF-8 bytes before percent encoding. JavaScript's encoding functions handle this automatically, but manual encoding may miss multi-byte characters.

Related Tools

Related Encoding Tools

Explore these related encoding and data conversion tools:

Frequently Asked Questions

What characters need URL encoding?
Characters that are not alphanumeric or - _ . ! ~ * ' must be encoded. This includes spaces (%20), ampersands (%26), equals signs (%3D), plus signs (%2B), and all non-ASCII characters. The exact set depends on whether you are encoding a query parameter or a full URL.
Should I encode the entire URL or just parameters?
Encode individual parameter values using encodeURIComponent(). Do not encode the entire URL structure (slashes, colons, etc.) as this will break the URL. Use encodeURI() only when you need to encode a complete URL with special characters.
What is double encoding?
Double encoding happens when you URL-encode a string that is already encoded. For example, encoding "%20" produces "%2520". This usually happens when data passes through multiple encoding stages. Always check if data is already encoded before applying encoding.
How do I decode a URL-encoded string?
Use decodeURIComponent() to decode individual parameter values, or decodeURI() for complete URLs. These functions reverse the encoding process, converting percent-encoded sequences back to their original characters.
Is URL encoding the same as Base64?
No. URL encoding replaces individual characters with percent-encoded sequences (%20 for space). Base64 encodes binary data as ASCII text. URL encoding is for making strings URL-safe, while Base64 is for representing binary data as text.