URL Encoder & Decoder
Encode text for safe use in a URL, decode a percent-escaped string, or paste a full URL to see its parts.
URL parser
What percent encoding is for
A URL may only contain a limited set of ASCII characters. Anything else — spaces, non-Latin letters, emoji — and any character that has structural meaning in a URL must be written as % followed by its two-digit hexadecimal byte value in UTF-8. A space becomes %20, an ampersand becomes %26, and é becomes %C3%A9 because it is two bytes in UTF-8.
encodeURI vs encodeURIComponent
These two JavaScript functions are the source of endless bugs:
| encodeURI | encodeURIComponent | |
|---|---|---|
| Intended for | A complete URL | A single value inside a URL |
| Leaves untouched | : / ? # [ ] @ ! $ & ' ( ) * + , ; = | Only - _ . ! ~ * ' ( ) |
| Use it when | You already have a valid URL and just want to escape spaces and non-ASCII | You are inserting a query parameter, path segment or form value |
The rule of thumb: if you are building a URL from parts, use encodeURIComponent on every part. Using encodeURI on a parameter value leaves & and = intact, which lets a value inject extra parameters.
Reserved characters worth remembering
| Character | Encoded | Why it matters |
|---|---|---|
| space | %20 (or + in form data) | Breaks the URL at the first space in many parsers |
& | %26 | Separates query parameters |
= | %3D | Separates a parameter name from its value |
# | %23 | Starts the fragment; everything after it is never sent to the server |
? | %3F | Starts the query string |
/ | %2F | Separates path segments |
+ | %2B | Means "space" in form encoding, so a literal plus must be escaped |
% | %25 | Starts an escape sequence — double-encoding bugs start here |
Double encoding
Encoding an already-encoded string turns %20 into %2520. If your URLs contain %25 where you expected a space, some layer is encoding twice — usually a framework helper applied on top of manual encoding.
Frequently asked questions
Why is a space sometimes %20 and sometimes +?
In the path and in modern query strings a space is %20. In application/x-www-form-urlencoded data — what an HTML form submits — it is +. Both decode back to a space, but only in the right context.
Should I encode the whole URL?
No. Encode each piece before assembling. Encoding a finished URL escapes the :// and ? that give it structure, or leaves parameter separators unescaped inside values.
Does URL encoding provide any security?
It prevents structural injection into a URL, which matters. It is not a defence against XSS or SQL injection — those need output escaping and parameterised queries at their own layer.
How are non-English characters handled?
They are converted to UTF-8 bytes first, then each byte is percent-escaped. That is why one Chinese character usually becomes three % sequences.