URL Encoder and Decoder Online
Percent-encode text for URLs or decode an encoded value for inspection. Choose the operation that matches the component you are working with.
URL Encoder & Decoder workspace
Percent Encoding
Converts unsafe characters into standard %xx format for reliable data transmission.
Instant Decoding
Reverts encoded strings back to human-readable text instantly.
Live Conversion
See results immediately as you type. No waiting, no page reloads.
100% Client-Side
Your data never leaves your browser. Secure and private processing.
URL Encoder & Decoder: Percent-Encode and Decode Text Online
Percent-encode text for URLs or decode an encoded value for inspection. Choose the operation that matches the component you are working with. A full URL and a query-parameter value have different escaping needs. Avoid encoding an already encoded value unless the receiving format explicitly requires it. Decoding exposes the represented text; it does not verify that a destination URL is trustworthy.
How to use the URL encoder and decoder
- Choose a mode: Encode (Text →
%XX) for new values, or Decode (%XX→ Text) for existing ones. - Paste your text or encoded string into the Input panel — one parameter value at a time, not a full
https://URL. - Read the result instantly in the Output panel; the character counters under each panel update live.
- Press the swap arrows to feed the output back as input and flip modes — handy for round-tripping a value.
- Click Copy to send the result to your clipboard, or the trash icon to clear the input.
What is URL encoding and how does it work?
URL encoding, or percent-encoding, represents a byte as a percent sign followed by two hexadecimal digits. The governing standard, RFC 3986, restricts a URI to a small ASCII set, so any character outside that set — or a reserved character used as data rather than a delimiter — must be escaped.
RFC 3986 §2.3 names exactly four unreserved punctuation marks that are always safe and never encoded: hyphen, period, underscore, and tilde (- . _ ~), alongside the letters A–Z a–z and digits 0–9. Everything else is reserved or non-ASCII. For non-ASCII input, the character is first converted to its UTF-8 byte sequence, then each byte is percent-encoded — which is why é becomes the two-byte %C3%A9.
"A percent-encoding mechanism is used to represent a data octet in a component when that octet's corresponding character is outside the allowed set or is being used as a delimiter." — RFC 3986, §2.1, Percent-Encoding
Worked examples: input → output
Encode · query value with a space and ampersand
hello world & more → hello%20world%20%26%20more
Encode · Unicode and emoji (UTF-8 bytes)
café 🚀 → caf%C3%A9%20%F0%9F%9A%80
Edge case · a literal + becomes a space on decode
On decode, this tool converts + to a space before running decodeURIComponent, matching form-encoding behavior. So decoding a+b returns a b, not a+b. If you need a literal plus to survive, encode it first — + becomes %2B, which decodes back to +.
Edge case · malformed percent-sequence
Decoding a stray % or invalid pair like %ZZ returns Error: Invalid URL encoding. rather than crashing. Supply both valid hex digits — for example %5A for Z — then decode again.
Percent-encoding reference: common characters
These are the encodings this tool produces. The five marked "extra" are RFC 3986 sub-delimiters that native encodeURIComponent leaves raw — this encoder re-escapes them for strict compliance.
| Character | Encoded | Role |
|---|---|---|
| space | %20 | Separator (not + here) |
| / | %2F | Path segment delimiter |
| ? | %3F | Query start delimiter |
| & | %26 | Parameter separator |
| = | %3D | Key/value separator |
| + | %2B | Literal plus (sub-delim) |
| ! | %21 | Extra escape (sub-delim) |
| ' | %27 | Extra escape (sub-delim) |
| ( ) | %28 %29 | Extra escape (sub-delim) |
| * | %2A | Extra escape (sub-delim) |
The five characters native encodeURIComponent quietly skips
JavaScript's built-in encodeURIComponent leaves five sub-delimiters untouched: exclamation, apostrophe, open and close parenthesis, and asterisk (! ' ( ) *). That is fine for most browser links but breaks signature schemes that expect a fully escaped string. This encoder fixes that by re-escaping all five to %21 %27 %28 %29 %2A, so its output is stricter than a raw encodeURIComponent call.
The decoder is deliberately asymmetric: it runs replace(/\+/g, ' ') before decodeURIComponent, so a + in your input is read as a space. That mirrors how servers parse application/x-www-form-urlencoded bodies. If a system signs requests — OAuth 1.0a or AWS S3, for example — pass values through this strict encoder so a raw ( or * never invalidates the signature.
encodeURIComponent vs encodeURI: which one is this?
This tool uses encodeURIComponent, which escapes the URI delimiters / ? : @ & = + $ # , so a single value is safe anywhere inside a URL. The alternative, encodeURI, deliberately leaves those delimiters intact to keep a whole https:// URL functional — meaning it will not encode a ? or & sitting inside your data. Because of that, paste one parameter value at a time here; encoding a full URL would escape the structural delimiters you want to keep. See the MDN encodeURIComponent reference for the exact character sets.
Related encoder & decoder tools
Split a URL into its components and query params
Base64 EncoderEncode binary or text data as ASCII Base64
Base64 DecoderDecode Base64 strings and URL tokens back to text
JWT DecoderRead the Base64url-encoded claims inside a JWT
HMAC GeneratorSign request strings with HMAC-SHA256
Hash GeneratorCompute MD5, SHA-1, and SHA-256 digests
Image to Base64Turn an image into a data-URI string
Base64 to ImagePreview and download a Base64 image
JSON FormatterValidate the API payloads you decode
All ToolsBrowse the full Toolk developer toolbox
Last updated: September 15, 2026 · Runs 100% in your browser — no uploads, tool input is not sent to Toolk.
Frequently asked questions
Why is a space encoded as %20 here instead of a plus sign?
RFC 3986 percent-encoding writes a space as %20; the + shorthand belongs to the older application/x-www-form-urlencoded format used by HTML forms. This tool encodes with %20 for strict compliance, and on decode it still accepts + as a space — encode a literal plus first (it becomes %2B) when the character must survive.
What happens if I paste an already full URL into the encoder?
It will be mangled: this tool applies encodeURIComponent, which escapes the structural delimiters / ? & = that make a complete URL work. Paste one parameter value at a time, or use Toolk's URL parser (/tools/url-parser) first to break a URL into components and encode only the values.
Is the text I encode or decode transmitted anywhere?
No. Both directions run locally with your browser's built-in encodeURIComponent and decodeURIComponent, so tool input is not sent to Toolk — Toolk's page analytics never receive your input — and malformed sequences like %ZZ return a clean error message instead of crashing.
Which characters does this encoder escape that native JavaScript skips?
Five sub-delimiters: ! ' ( ) *. Native encodeURIComponent leaves them raw, which is fine for ordinary links but breaks signature schemes such as OAuth 1.0a or AWS S3 that expect fully escaped strings. This encoder re-escapes them to %21 %27 %28 %29 %2A, so its output is stricter than a plain encodeURIComponent call.