URL Encode & Decode
Percent-encode text for a URL, or decode %20, + and %C3%A9 back to readable text. Split any URL into its parts and query parameters. Everything runs in your browser.
Parts
Query parameters
| # | Name | Value (decoded) |
|---|
This URL has no query parameters.
How to use this URL encoder and decoder
- Decode: paste text that contains
%20,%3D,%C3%A9or+. The readable text appears on the right as you type. Untick Read + as a space if the text is a path where+is a real plus sign. - Encode: click Encode and choose what the text is for. Query value or path part encodes everything that could break a URL, including
&,=,/and?. Whole URL keeps the URL structure and only fixes spaces and other unsafe characters; %-codes that are already there are kept, so nothing is encoded twice. Form data writes spaces as+. - Double encoding: if the decoded text still contains %-codes (for example
%2520), the tool says so and shows a Decode again button. - Lists: tick Each line separately to encode or decode many values at once, one per line.
- Split a URL: paste a link into the second box to see its protocol, host, port, path, fragment and every query parameter, decoded. Copy as JSON gives you the parameters as an object.
Nothing you paste leaves your browser: there is no upload, no log and no storage.
What is URL encoding?
A URL may only contain a small set of ASCII characters, and some of them have a job: ? starts the query, & separates parameters, = separates a name from its value, # starts the fragment and / separates path parts. URL encoding (officially percent-encoding, RFC 3986) writes any other character, or a special character that should be taken literally, as % plus two hexadecimal digits: the value of the byte.
Text is first turned into UTF-8 bytes. Here is café & tea as a query value:
| Character | c a f | é | space | & | space | t e a |
|---|---|---|---|---|---|---|
| UTF-8 bytes (hex) | 63 61 66 | C3 A9 | 20 | 26 | 20 | 74 65 61 |
| Encoded | caf | %C3%A9 | %20 | %26 | %20 | tea |
So the result is caf%C3%A9%20%26%20tea. Without encoding, the & would end the value and start a new parameter called tea.
Which characters must be encoded?
| Group | Characters | Rule |
|---|---|---|
| Unreserved | A–Z a–z 0–9 - _ . ~ | Never need encoding |
| Reserved (structure) | : / ? # [ ] @ ! $ & ' ( ) * + , ; = | Encode them inside a value, keep them where they give the URL its structure |
| Everything else | space, " % < > \ ^ ` { | }, accents, CJK, emoji, control characters | Always encode |
Common URL encoding codes
Hex digits may be upper or lower case: %2f and %2F mean the same, but upper case is the standard form.
encodeURI vs. encodeURIComponent and %20 vs. +
| Function | Input a b&c/d?é becomes | Use it for |
|---|---|---|
encodeURIComponent | a%20b%26c%2Fd%3F%C3%A9 | One query value, one path segment, a redirect URL inside a parameter |
encodeURI | a%20b&c/d?%C3%A9 | A whole URL that has spaces or accents in it |
Form data (URLSearchParams, PHP urlencode) | a+b%26c%2Fd%3F%C3%A9 | HTML form posts and query strings built by a form |
%20 or +? %20 is a space everywhere in a URL. + is a space only in form-encoded query strings; in a path it is a plus sign. When you decode a query string, read + as a space. When you encode and are not sure, use %20.
Double encoding happens when already-encoded text is encoded again: % becomes %25, so %20 turns into %2520. Encode each value exactly once, just before you put it into the URL.
URL encoding in code
| Language | Encode | Decode |
|---|---|---|
| JavaScript | encodeURIComponent(s) | decodeURIComponent(s) |
| JavaScript (query) | new URLSearchParams({ q: s }).toString() | new URLSearchParams(qs).get('q') |
| Python | urllib.parse.quote(s, safe='') / quote_plus(s) | urllib.parse.unquote(s) / unquote_plus(s) |
| Java | URLEncoder.encode(s, StandardCharsets.UTF_8) | URLDecoder.decode(s, StandardCharsets.UTF_8) |
| C# | Uri.EscapeDataString(s) | Uri.UnescapeDataString(s) |
| PHP | rawurlencode($s) / urlencode($s) | rawurldecode($s) / urldecode($s) |
| Go | url.QueryEscape(s) / url.PathEscape(s) | url.QueryUnescape(s) |
| curl | curl -G --data-urlencode "q=a b" URL | — |
Java URLEncoder, PHP urlencode, Python quote_plus and Go QueryEscape write spaces as + (form style). rawurlencode, quote, EscapeDataString and PathEscape write %20.
Frequently asked questions
What is URL encoding?
URL encoding, also called percent-encoding, writes a character that is not allowed or has a special meaning in a URL as a % sign followed by two hexadecimal digits. A space becomes %20, & becomes %26 and / becomes %2F. Letters, digits and - _ . ~ never need encoding.
Should a space be %20 or +?
Both are common. %20 works everywhere in a URL. + means a space only in the query string of HTML form data (application/x-www-form-urlencoded), which is what PHP urlencode, Python quote_plus and Java URLEncoder produce. In a path, + is a real plus sign. If you are not sure, use %20.
What is the difference between encodeURI and encodeURIComponent?
encodeURI is for a whole URL: it keeps the characters that give a URL its structure, such as : / ? # & and =. encodeURIComponent is for one piece, such as a single query value: it also encodes those characters, so a value that contains & or = cannot break the URL. For query values, always use encodeURIComponent.
Why does my URL contain %2520?
The text was encoded twice. The first time a space became %20; the second time the % sign itself became %25, so %20 turned into %2520. Decode it once to get %20, and once more to get the space. This tool notices when a result still contains %-codes and offers a Decode again button.
How are accents, Chinese characters and emoji encoded?
The character is first turned into its UTF-8 bytes, and each byte is written as %XX. é is 2 bytes and becomes %C3%A9, 你 is 3 bytes and becomes %E4%BD%A0, and most emoji are 4 bytes. All modern browsers and servers use UTF-8 for URLs.
Why does decodeURIComponent throw "URI malformed"?
The text contains a % sign that is not followed by two hex digits (for example 100% or %G1), or %-codes whose bytes are not valid UTF-8 (often old Latin-1 text such as %E9 for é). This decoder does not stop: it keeps a lone % as it is, reads non-UTF-8 bytes as Windows-1252 and tells you the exact position.
Is my data sent to a server?
No. Encoding, decoding and URL parsing all run in your browser with JavaScript. Nothing you paste is uploaded or stored, so it is safe to use with private links and tokens.