URL Encoder and Decoder
Type or paste text to percent encode it for a link, or paste an encoded string to read it back. When the input is a full web address, a table splits it into its scheme, host, path, query parameters and fragment. Nothing you enter leaves this browser tab.
Encoding a value also escapes / ? & = and #. Encoding a whole URL leaves them, since they hold the address together.
Limits: Up to 1 MB of text. Larger input is refused with a message.
Results
- Characters in
- -
- Characters out
- -
- Percent escapes
- -
- Read as a URL
- -
| Part | As parsed | Decoded |
|---|
| # | Name | Value |
|---|
Result
How to use the URL Encoder and Decoder
- Paste the text or the address into the box, or press Load the example.
- Choose what to do: encode one value, encode a whole URL, or decode, with a form variant of each where + stands for a space.
- Read the result and any note below the box about characters that needed care.
- Copy the result, and check the URL parts table when you pasted a full address.
Worked example
You want to pass a search address as the value of a next= parameter, so it has to be encoded as one component. Press Load the example to see every : / ? = and & escaped, and the address split into its parts in the tables. Its spaces become %20 in the parsed form.
https://example.com/search?q=café au lait&lang=fr
- What to do
- Encode a value (encodeURIComponent)
- Characters in
- 49
- Characters out
- 74
- Percent escapes
- 12
- Read as a URL
- Yes
- Result
https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dcaf%C3%A9%20au%20lait%26lang%3Dfr
How to read the results
- Characters in and Characters out
- The length before and after, counted in characters, so an emoji counts once. Encoding makes text longer: each escaped byte becomes three characters.
- Percent escapes
- How many %XX sequences the result contains after encoding, or how many the input held before decoding.
- Read as a URL
- Yes when the input, or the decoded result, is an absolute address the browser's URL parser accepts. The tables below then show its parts.
- URL parts
- Protocol, user name and password when present, host, port, path, query and hash (the fragment after #). As parsed is the normalized form the browser stores; Decoded shows it with escapes turned back into characters.
- Query parameters
- Each name and value from the query string in order, decoded the way URLSearchParams decodes them, with + read as a space. A name that repeats is listed every time.
- Notes
- An error stops the result and names the character at fault. A warning means the output may surprise you, for example text that was already encoded. An info note explains a choice the mode made.
How this tool works and its limitations
The encode options call the browser's encodeURIComponent or encodeURI on the text. Both functions throw on a lone surrogate, so any such character is first replaced with U+FFFD and reported. The form option starts from component encoding, escapes ! ' ( ) and ~ as well and writes each space as +, matching the serializer that URLSearchParams uses. All three write the text as UTF-8 bytes.
Decoding does not lean on decodeURIComponent, whose error says only that something is malformed. The page reads the text itself, turns each run of %XX escapes into bytes and checks those bytes as UTF-8, so it can name the first bad character. Strict decoding follows the rules of decodeURIComponent and stops there; form decoding follows the URL Standard, reading + as a space and replacing bad bytes with U+FFFD. Addresses are split with the URL API inside a try block, so input that is not an address simply shows no table. Nothing you type is sent or stored, and these limits apply:
- Text is always encoded and decoded as UTF-8. Addresses from older systems that used another character set will not decode to the right letters.
- A lone surrogate, half of an emoji pair that lost its partner, cannot be written in UTF-8; it is encoded as U+FFFD and the page says where it was.
- The URL parts table shows the address after the URL parser has normalized it, so the host may be in lower case, an international domain name is shown in its xn-- form and a default port is left out.
- Strict decoding stops at the first bad escape. Form decoding goes on, keeping a stray % and showing U+FFFD for bytes that are not UTF-8.
- The parts table appears only for an absolute URL with a scheme such as https: at the start. A relative path like /search?q=x is encoded and decoded but not broken down.
- Input is capped at 1 MB of text, and a result longer than 100,000 characters shows only its start in the box while Copy takes all of it.
Features
- The browser's own encodeURIComponent and encodeURI, so the output matches what your scripts produce.
- Decoding that names the exact character of a broken escape instead of throwing a bare URIError.
- A breakdown of any absolute URL, with every query parameter decoded the way URLSearchParams reads it.
- Correct UTF-8 for accents, other scripts and emoji, plus a warning for broken surrogate pairs.
Encode a value or a whole address: why it matters
encodeURIComponent escapes everything except letters, digits and - _ . ! ~ * ' ( ). That suits one piece of data, such as a search term or a return address placed inside another link, because a / or & in it must not end the parameter. encodeURI also keeps ; / ? : @ & = + $ , and # as they are, so it suits an address that is already put together and only needs its spaces and accents escaped. Run it on a lone value and an ampersand inside that value quietly splits it into two parameters.
Plus signs, spaces and form data
Web forms use their own rules, defined as application/x-www-form-urlencoded in the URL Standard. A space becomes + and a few more characters are escaped than encodeURIComponent escapes. MDN on URLSearchParams warns that its parser reads every + as a space, so Base64 text holding + signs arrives broken unless the signs were written as %2B. Plain decodeURIComponent keeps + as it is, which is why this page has a separate form option.
What a percent escape really is
A percent escape is one byte written as % and two hexadecimal digits, and a character outside ASCII takes several of them: é is the two UTF-8 bytes %C3%A9 and an emoji takes four. MDN's decodeURIComponent page lists two ways to fail: a % without two hex digits after it, and bytes that do not form valid UTF-8. A string encoded twice shows %2520 where a space should be, because the % of %20 was itself escaped. Decode it twice, or better, find the step that encoded it again.
Frequently asked questions
Should I use encodeURI or encodeURIComponent?
Use component encoding for anything you place inside a URL, such as a parameter value or a path segment. Use whole URL encoding only on a complete address that already has its structure and just needs spaces and non ASCII letters escaped.
Why does my decoded text show strange characters such as é?
The bytes were UTF-8 but something read them as Latin 1, or the text went through two encoders that disagreed. This page always decodes UTF-8, so if é appears here the text was already damaged before it was encoded.
What does a URIError: malformed URI sequence mean?
It is how decodeURIComponent reports a % that is not followed by two hex digits, or escapes that are not valid UTF-8. Paste the same text here in decode mode and the notice names the character where it goes wrong.
Is %20 or + correct for a space?
Both, in different places. In a path, %20 is the only correct form. In a query string built by a form or by URLSearchParams, + is normal and the server reads it as a space. Choose the form options for that case.
Does encoding a URL make it safe to put in a page?
Percent encoding keeps an address intact while it travels; it is not a security measure. A link to a harmful site stays harmful when encoded, and putting text into HTML needs HTML escaping, a different step.
Why is the host in the table different from what I typed?
The URL parser normalizes as it reads: it lowers the case of the host, drops a default port such as :443 and converts an international domain name to its xn-- form, the one DNS uses.
Last updated .