URL Encoder & Decoder Online — Free Percent-Encoding Tool
Percent-encode text into %XX format or decode it back, strictly to RFC 3986. Encode query strings, spaces, and Unicode safely. Free, 100% in your browser.
Percent Encoding
Converts unsafe characters into standard %xx format for reliable data transmission.
Instant Decoding
Reverts encoded strings back to human-readable text instantly.
Live Conversion
See results immediately as you type. No waiting, no page reloads.
100% Client-Side
Your data never leaves your browser. Secure and private processing.
URL Encoder & Decoder: Percent-Encode and Decode Text Online
A URL encoder rewrites unsafe characters as percent-codes — a space becomes %20, an ampersand becomes %26 — so text travels safely inside a query string or URI path. Paste a value, pick Encode or Decode, and the result updates as you type. Encoding uses encodeURIComponent with strict RFC 3986 escaping; everything runs free and 100% in your browser.
How to encode or decode a URL
- Choose a mode: Encode (Text →
%XX) for new values, or Decode (%XX→ Text) for existing ones. - Paste your text or encoded string into the Input panel — one parameter value at a time, not a full
https://URL. - Read the result instantly in the Output panel; the character counters under each panel update live.
- Press the swap arrows to feed the output back as input and flip modes — handy for round-tripping a value.
- Click Copy to send the result to your clipboard, or the trash icon to clear the input.
What is URL encoding and how does it work?
URL encoding, or percent-encoding, represents a byte as a percent sign followed by two hexadecimal digits. The governing standard, RFC 3986, restricts a URI to a small ASCII set, so any character outside that set — or a reserved character used as data rather than a delimiter — must be escaped.
RFC 3986 §2.3 names exactly four unreserved punctuation marks that are always safe and never encoded: hyphen, period, underscore, and tilde (- . _ ~), alongside the letters A–Z a–z and digits 0–9. Everything else is reserved or non-ASCII. For non-ASCII input, the character is first converted to its UTF-8 byte sequence, then each byte is percent-encoded — which is why é becomes the two-byte %C3%A9.
"A percent-encoding mechanism is used to represent a data octet in a component when that octet's corresponding character is outside the allowed set or is being used as a delimiter."— RFC 3986, §2.1, Percent-Encoding
Worked examples: input → output
Encode · query value with a space and ampersand
hello world & more → hello%20world%20%26%20more
Encode · Unicode and emoji (UTF-8 bytes)
café 🚀 → caf%C3%A9%20%F0%9F%9A%80
Edge case · a literal + becomes a space on decode
On decode, this tool converts + to a space before running decodeURIComponent, matching form-encoding behavior. So decoding a+b returns a b, not a+b. If you need a literal plus to survive, encode it first — + becomes %2B, which decodes back to +.
Edge case · malformed percent-sequence
Decoding a stray % or invalid pair like %ZZ returns Error: Invalid URL encoding. rather than crashing. Supply both valid hex digits — for example %5A for Z — then decode again.
Percent-encoding reference: common characters
These are the encodings this tool produces. The five marked "extra" are RFC 3986 sub-delimiters that native encodeURIComponent leaves raw — this encoder re-escapes them for strict compliance.
| Character | Encoded | Role |
|---|---|---|
| space | %20 | Separator (not + here) |
| / | %2F | Path segment delimiter |
| ? | %3F | Query start delimiter |
| & | %26 | Parameter separator |
| = | %3D | Key/value separator |
| + | %2B | Literal plus (sub-delim) |
| ! | %21 | Extra escape (sub-delim) |
| ' | %27 | Extra escape (sub-delim) |
| ( ) | %28 %29 | Extra escape (sub-delim) |
| * | %2A | Extra escape (sub-delim) |
The five characters native encodeURIComponent quietly skips
JavaScript's built-in encodeURIComponent leaves five sub-delimiters untouched: exclamation, apostrophe, open and close parenthesis, and asterisk (! ' ( ) *). That is fine for most browser links but breaks signature schemes that expect a fully escaped string. This encoder fixes that by re-escaping all five to %21 %27 %28 %29 %2A, so its output is stricter than a raw encodeURIComponent call.
The decoder is deliberately asymmetric: it runs replace(/\+/g, ' ') before decodeURIComponent, so a + in your input is read as a space. That mirrors how servers parse application/x-www-form-urlencoded bodies. If a system signs requests — OAuth 1.0a or AWS S3, for example — pass values through this strict encoder so a raw ( or * never invalidates the signature.
encodeURIComponent vs encodeURI: which one is this?
This tool uses encodeURIComponent, which escapes the URI delimiters / ? : @ & = + $ # , so a single value is safe anywhere inside a URL. The alternative, encodeURI, deliberately leaves those delimiters intact to keep a whole https:// URL functional — meaning it will not encode a ? or & sitting inside your data. Because of that, paste one parameter value at a time here; encoding a full URL would escape the structural delimiters you want to keep. See the MDN encodeURIComponent reference for the exact character sets.
Runs 100% in your browser
Your data never leaves your device. Encoding and decoding run locally with the browser's native encodeURIComponent and decodeURIComponent, and copying uses your clipboard — no uploads, nothing leaves your device. I tested round-trips with spaces, ampersands, the literal +, accented Latin (é → %C3%A9), and a four-byte emoji (🚀 → %F0%9F%9A%80), plus malformed input like a lone % to confirm it returns a clean error instead of crashing.
Frequently asked questions
Is this URL encoder free and private?
Yes — 100% free with no signup and no limits. Every conversion runs in your browser, so your input never reaches a server and the tool works offline once the page loads.
Why is a space encoded as %20 and not +?
Because RFC 3986 uses %20 for a space in a URI. The + only means a space in the older form-encoding format. On decode, this tool still treats + as a space, so encode a literal plus first to get %2B.
Should I paste a whole URL or a single value?
Paste a single value. This tool uses encodeURIComponent, which escapes / ? & = and other delimiters — useful for one parameter, but it would mangle the structure of a complete URL.
Does it handle emoji and non-English text?
Yes. Non-ASCII characters are converted to UTF-8 bytes, then each byte is percent-encoded — é becomes %C3%A9 and the rocket emoji becomes %F0%9F%9A%80.
Related encoder & decoder tools
Split a URL into its components and query params
Base64 EncoderEncode binary or text data as ASCII Base64
Base64 DecoderDecode Base64 strings and URL tokens back to text
JWT DecoderRead the Base64url-encoded claims inside a JWT
HMAC GeneratorSign request strings with HMAC-SHA256
Hash GeneratorCompute MD5, SHA-1, and SHA-256 digests
Image to Base64Turn an image into a data-URI string
Base64 to ImagePreview and download a Base64 image
JSON FormatterValidate the API payloads you decode
All ToolsBrowse the full Toolk developer toolbox
Last updated: June 2, 2026 · Runs 100% in your browser — no uploads, nothing leaves your device.
Need a different tool?
Browse all 89 free, in-browser tools — or tell us what we should build next.